Add missing patch for 3.4.120120609

2 files changed, 2651 insertions, 0 deletions

diff --git a/3.4.1/0000_README b/3.4.1/0000_README
index 77e912a..69d223e 100644
--- a/3.4.1/0000_README
+++ b/3.4.1/0000_README
@@ -2,6 +2,10 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
+Patch:	1000_linux-3.4.1.patch
+From:	http://www.kernel.org
+Desc:	Linux 3.4.1
+
 Patch:	4420_grsecurity-2.9.1-3.4.1-201206091540.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
diff --git a/3.4.1/1000_linux-3.4.1.patch b/3.4.1/1000_linux-3.4.1.patch
new file mode 100644
index 0000000..209c25a
--- /dev/null
+++ b/3.4.1/1000_linux-3.4.1.patch
@@ -0,0 +1,2647 @@
+diff --git a/Documentation/HOWTO b/Documentation/HOWTO
+index f7ade3b..59c080f 100644
+--- a/Documentation/HOWTO
++++ b/Documentation/HOWTO
+@@ -218,16 +218,16 @@ The development process
+ Linux kernel development process currently consists of a few different
+ main kernel "branches" and lots of different subsystem-specific kernel
+ branches.  These different branches are:
+-  - main 2.6.x kernel tree
+-  - 2.6.x.y -stable kernel tree
+-  - 2.6.x -git kernel patches
++  - main 3.x kernel tree
++  - 3.x.y -stable kernel tree
++  - 3.x -git kernel patches
+   - subsystem specific kernel trees and patches
+-  - the 2.6.x -next kernel tree for integration tests
++  - the 3.x -next kernel tree for integration tests
+ 
+-2.6.x kernel tree
++3.x kernel tree
+ -----------------
+-2.6.x kernels are maintained by Linus Torvalds, and can be found on
+-kernel.org in the pub/linux/kernel/v2.6/ directory.  Its development
++3.x kernels are maintained by Linus Torvalds, and can be found on
++kernel.org in the pub/linux/kernel/v3.x/ directory.  Its development
+ process is as follows:
+   - As soon as a new kernel is released a two weeks window is open,
+     during this period of time maintainers can submit big diffs to
+@@ -262,20 +262,20 @@ mailing list about kernel releases:
+ 	released according to perceived bug status, not according to a
+ 	preconceived timeline."
+ 
+-2.6.x.y -stable kernel tree
++3.x.y -stable kernel tree
+ ---------------------------
+-Kernels with 4-part versions are -stable kernels. They contain
++Kernels with 3-part versions are -stable kernels. They contain
+ relatively small and critical fixes for security problems or significant
+-regressions discovered in a given 2.6.x kernel.
++regressions discovered in a given 3.x kernel.
+ 
+ This is the recommended branch for users who want the most recent stable
+ kernel and are not interested in helping test development/experimental
+ versions.
+ 
+-If no 2.6.x.y kernel is available, then the highest numbered 2.6.x
++If no 3.x.y kernel is available, then the highest numbered 3.x
+ kernel is the current stable kernel.
+ 
+-2.6.x.y are maintained by the "stable" team <stable@vger.kernel.org>, and
++3.x.y are maintained by the "stable" team <stable@vger.kernel.org>, and
+ are released as needs dictate.  The normal release period is approximately
+ two weeks, but it can be longer if there are no pressing problems.  A
+ security-related problem, instead, can cause a release to happen almost
+@@ -285,7 +285,7 @@ The file Documentation/stable_kernel_rules.txt in the kernel tree
+ documents what kinds of changes are acceptable for the -stable tree, and
+ how the release process works.
+ 
+-2.6.x -git patches
++3.x -git patches
+ ------------------
+ These are daily snapshots of Linus' kernel tree which are managed in a
+ git repository (hence the name.) These patches are usually released
+@@ -317,13 +317,13 @@ revisions to it, and maintainers can mark patches as under review,
+ accepted, or rejected.  Most of these patchwork sites are listed at
+ http://patchwork.kernel.org/.
+ 
+-2.6.x -next kernel tree for integration tests
++3.x -next kernel tree for integration tests
+ ---------------------------------------------
+-Before updates from subsystem trees are merged into the mainline 2.6.x
++Before updates from subsystem trees are merged into the mainline 3.x
+ tree, they need to be integration-tested.  For this purpose, a special
+ testing repository exists into which virtually all subsystem trees are
+ pulled on an almost daily basis:
+-	http://git.kernel.org/?p=linux/kernel/git/sfr/linux-next.git
++	http://git.kernel.org/?p=linux/kernel/git/next/linux-next.git
+ 	http://linux.f-seidel.de/linux-next/pmwiki/
+ 
+ This way, the -next kernel gives a summary outlook onto what will be
+diff --git a/Makefile b/Makefile
+index a687963..0bd1554 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 4
+-SUBLEVEL = 0
++SUBLEVEL = 1
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+ 
+diff --git a/arch/arm/boot/dts/tegra-cardhu.dts b/arch/arm/boot/dts/tegra-cardhu.dts
+index ac3fb75..631a86c 100644
+--- a/arch/arm/boot/dts/tegra-cardhu.dts
++++ b/arch/arm/boot/dts/tegra-cardhu.dts
+@@ -64,7 +64,7 @@
+ 		status = "disable";
+ 	};
+ 
+-	sdhci@78000400 {
++	sdhci@78000600 {
+ 		support-8bit;
+ 	};
+ };
+diff --git a/arch/arm/include/asm/cacheflush.h b/arch/arm/include/asm/cacheflush.h
+index d5d8d5c..1252a26 100644
+--- a/arch/arm/include/asm/cacheflush.h
++++ b/arch/arm/include/asm/cacheflush.h
+@@ -249,7 +249,7 @@ extern void flush_cache_page(struct vm_area_struct *vma, unsigned long user_addr
+  * Harvard caches are synchronised for the user space address range.
+  * This is used for the ARM private sys_cacheflush system call.
+  */
+-#define flush_cache_user_range(vma,start,end) \
++#define flush_cache_user_range(start,end) \
+ 	__cpuc_coherent_user_range((start) & PAGE_MASK, PAGE_ALIGN(end))
+ 
+ /*
+diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
+index 7784547..63d402f 100644
+--- a/arch/arm/kernel/traps.c
++++ b/arch/arm/kernel/traps.c
+@@ -496,7 +496,9 @@ do_cache_op(unsigned long start, unsigned long end, int flags)
+ 		if (end > vma->vm_end)
+ 			end = vma->vm_end;
+ 
+-		flush_cache_user_range(vma, start, end);
++		up_read(&mm->mmap_sem);
++		flush_cache_user_range(start, end);
++		return;
+ 	}
+ 	up_read(&mm->mmap_sem);
+ }
+diff --git a/arch/powerpc/kernel/idle.c b/arch/powerpc/kernel/idle.c
+index 6d2209a..04d7909 100644
+--- a/arch/powerpc/kernel/idle.c
++++ b/arch/powerpc/kernel/idle.c
+@@ -113,6 +113,9 @@ void cpu_idle(void)
+ 	}
+ }
+ 
++static void do_nothing(void *unused)
++{
++}
+ 
+ /*
+  * cpu_idle_wait - Used to ensure that all the CPUs come out of the old
+@@ -123,16 +126,9 @@ void cpu_idle(void)
+  */
+ void cpu_idle_wait(void)
+ {
+-	int cpu;
+ 	smp_mb();
+-
+-	/* kick all the CPUs so that they exit out of old idle routine */
+-	get_online_cpus();
+-	for_each_online_cpu(cpu) {
+-		if (cpu != smp_processor_id())
+-			smp_send_reschedule(cpu);
+-	}
+-	put_online_cpus();
++	/* kick all the CPUs so that they exit out of pm_idle */
++	smp_call_function(do_nothing, NULL, 1);
+ }
+ EXPORT_SYMBOL_GPL(cpu_idle_wait);
+ 
+diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c
+index 46ef3fd..4e66860 100644
+--- a/arch/s390/mm/fault.c
++++ b/arch/s390/mm/fault.c
+@@ -574,6 +574,7 @@ static void pfault_interrupt(struct ext_code ext_code,
+ 			tsk->thread.pfault_wait = 0;
+ 			list_del(&tsk->thread.list);
+ 			wake_up_process(tsk);
++			put_task_struct(tsk);
+ 		} else {
+ 			/* Completion interrupt was faster than initial
+ 			 * interrupt. Set pfault_wait to -1 so the initial
+@@ -588,14 +589,22 @@ static void pfault_interrupt(struct ext_code ext_code,
+ 		put_task_struct(tsk);
+ 	} else {
+ 		/* signal bit not set -> a real page is missing. */
+-		if (tsk->thread.pfault_wait == -1) {
++		if (tsk->thread.pfault_wait == 1) {
++			/* Already on the list with a reference: put to sleep */
++			set_task_state(tsk, TASK_UNINTERRUPTIBLE);
++			set_tsk_need_resched(tsk);
++		} else if (tsk->thread.pfault_wait == -1) {
+ 			/* Completion interrupt was faster than the initial
+ 			 * interrupt (pfault_wait == -1). Set pfault_wait
+ 			 * back to zero and exit. */
+ 			tsk->thread.pfault_wait = 0;
+ 		} else {
+ 			/* Initial interrupt arrived before completion
+-			 * interrupt. Let the task sleep. */
++			 * interrupt. Let the task sleep.
++			 * An extra task reference is needed since a different
++			 * cpu may set the task state to TASK_RUNNING again
++			 * before the scheduler is reached. */
++			get_task_struct(tsk);
+ 			tsk->thread.pfault_wait = 1;
+ 			list_add(&tsk->thread.list, &pfault_list);
+ 			set_task_state(tsk, TASK_UNINTERRUPTIBLE);
+@@ -620,6 +629,7 @@ static int __cpuinit pfault_cpu_notify(struct notifier_block *self,
+ 			list_del(&thread->list);
+ 			tsk = container_of(thread, struct task_struct, thread);
+ 			wake_up_process(tsk);
++			put_task_struct(tsk);
+ 		}
+ 		spin_unlock_irq(&pfault_lock);
+ 		break;
+diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
+index 6c0683d..76c7ccf 100644
+--- a/arch/sparc/Kconfig
++++ b/arch/sparc/Kconfig
+@@ -584,6 +584,9 @@ config SYSVIPC_COMPAT
+ 	depends on COMPAT && SYSVIPC
+ 	default y
+ 
++config KEYS_COMPAT
++	def_bool y if COMPAT && KEYS
++
+ endmenu
+ 
+ source "net/Kconfig"
+diff --git a/arch/sparc/kernel/systbls_64.S b/arch/sparc/kernel/systbls_64.S
+index db86b1a..3a58e0d 100644
+--- a/arch/sparc/kernel/systbls_64.S
++++ b/arch/sparc/kernel/systbls_64.S
+@@ -74,7 +74,7 @@ sys_call_table32:
+ 	.word sys_timer_delete, compat_sys_timer_create, sys_ni_syscall, compat_sys_io_setup, sys_io_destroy
+ /*270*/	.word sys32_io_submit, sys_io_cancel, compat_sys_io_getevents, sys32_mq_open, sys_mq_unlink
+ 	.word compat_sys_mq_timedsend, compat_sys_mq_timedreceive, compat_sys_mq_notify, compat_sys_mq_getsetattr, compat_sys_waitid
+-/*280*/	.word sys32_tee, sys_add_key, sys_request_key, sys_keyctl, compat_sys_openat
++/*280*/	.word sys32_tee, sys_add_key, sys_request_key, compat_sys_keyctl, compat_sys_openat
+ 	.word sys_mkdirat, sys_mknodat, sys_fchownat, compat_sys_futimesat, compat_sys_fstatat64
+ /*290*/	.word sys_unlinkat, sys_renameat, sys_linkat, sys_symlinkat, sys_readlinkat
+ 	.word sys_fchmodat, sys_faccessat, compat_sys_pselect6, compat_sys_ppoll, sys_unshare
+diff --git a/arch/tile/include/asm/bitops.h b/arch/tile/include/asm/bitops.h
+index 16f1fa5..bd186c4 100644
+--- a/arch/tile/include/asm/bitops.h
++++ b/arch/tile/include/asm/bitops.h
+@@ -77,6 +77,11 @@ static inline int ffs(int x)
+ 	return __builtin_ffs(x);
+ }
+ 
++static inline int fls64(__u64 w)
++{
++	return (sizeof(__u64) * 8) - __builtin_clzll(w);
++}
++
+ /**
+  * fls - find last set bit in word
+  * @x: the word to search
+@@ -90,12 +95,7 @@ static inline int ffs(int x)
+  */
+ static inline int fls(int x)
+ {
+-	return (sizeof(int) * 8) - __builtin_clz(x);
+-}
+-
+-static inline int fls64(__u64 w)
+-{
+-	return (sizeof(__u64) * 8) - __builtin_clzll(w);
++	return fls64((unsigned int) x);
+ }
+ 
+ static inline unsigned int __arch_hweight32(unsigned int w)
+diff --git a/arch/um/include/asm/pgtable.h b/arch/um/include/asm/pgtable.h
+index 6a3f984..5888f1b 100644
+--- a/arch/um/include/asm/pgtable.h
++++ b/arch/um/include/asm/pgtable.h
+@@ -273,6 +273,12 @@ static inline void set_pte(pte_t *pteptr, pte_t pteval)
+ }
+ #define set_pte_at(mm,addr,ptep,pteval) set_pte(ptep,pteval)
+ 
++#define __HAVE_ARCH_PTE_SAME
++static inline int pte_same(pte_t pte_a, pte_t pte_b)
++{
++	return !((pte_val(pte_a) ^ pte_val(pte_b)) & ~_PAGE_NEWPAGE);
++}
++
+ /*
+  * Conversion functions: convert a page and protection to a page entry,
+  * and a page entry and page directory to the page they refer to.
+@@ -348,11 +354,11 @@ extern pte_t *virt_to_pte(struct mm_struct *mm, unsigned long addr);
+ #define update_mmu_cache(vma,address,ptep) do ; while (0)
+ 
+ /* Encode and de-code a swap entry */
+-#define __swp_type(x)			(((x).val >> 4) & 0x3f)
++#define __swp_type(x)			(((x).val >> 5) & 0x1f)
+ #define __swp_offset(x)			((x).val >> 11)
+ 
+ #define __swp_entry(type, offset) \
+-	((swp_entry_t) { ((type) << 4) | ((offset) << 11) })
++	((swp_entry_t) { ((type) << 5) | ((offset) << 11) })
+ #define __pte_to_swp_entry(pte) \
+ 	((swp_entry_t) { pte_val(pte_mkuptodate(pte)) })
+ #define __swp_entry_to_pte(x)		((pte_t) { (x).val })
+diff --git a/arch/x86/Makefile b/arch/x86/Makefile
+index 94e91e4..b1c611e 100644
+--- a/arch/x86/Makefile
++++ b/arch/x86/Makefile
+@@ -206,6 +206,7 @@ archclean:
+ 	$(Q)rm -rf $(objtree)/arch/i386
+ 	$(Q)rm -rf $(objtree)/arch/x86_64
+ 	$(Q)$(MAKE) $(clean)=$(boot)
++	$(Q)$(MAKE) $(clean)=arch/x86/tools
+ 
+ define archhelp
+   echo  '* bzImage      - Compressed kernel image (arch/x86/boot/bzImage)'
+diff --git a/arch/x86/kernel/cpu/mcheck/mce-severity.c b/arch/x86/kernel/cpu/mcheck/mce-severity.c
+index 0c82091..1ccd453 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce-severity.c
++++ b/arch/x86/kernel/cpu/mcheck/mce-severity.c
+@@ -165,15 +165,19 @@ static struct severity {
+ };
+ 
+ /*
+- * If the EIPV bit is set, it means the saved IP is the
+- * instruction which caused the MCE.
++ * If mcgstatus indicated that ip/cs on the stack were
++ * no good, then "m->cs" will be zero and we will have
++ * to assume the worst case (IN_KERNEL) as we actually
++ * have no idea what we were executing when the machine
++ * check hit.
++ * If we do have a good "m->cs" (or a faked one in the
++ * case we were executing in VM86 mode) we can use it to
++ * distinguish an exception taken in user from from one
++ * taken in the kernel.
+  */
+ static int error_context(struct mce *m)
+ {
+-	if (m->mcgstatus & MCG_STATUS_EIPV)
+-		return (m->ip && (m->cs & 3) == 3) ? IN_USER : IN_KERNEL;
+-	/* Unknown, assume kernel */
+-	return IN_KERNEL;
++	return ((m->cs & 3) == 3) ? IN_USER : IN_KERNEL;
+ }
+ 
+ int mce_severity(struct mce *m, int tolerant, char **msg)
+diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
+index 11c9166..61604ae 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce.c
++++ b/arch/x86/kernel/cpu/mcheck/mce.c
+@@ -437,6 +437,14 @@ static inline void mce_gather_info(struct mce *m, struct pt_regs *regs)
+ 		if (m->mcgstatus & (MCG_STATUS_RIPV|MCG_STATUS_EIPV)) {
+ 			m->ip = regs->ip;
+ 			m->cs = regs->cs;
++
++			/*
++			 * When in VM86 mode make the cs look like ring 3
++			 * always. This is a lie, but it's better than passing
++			 * the additional vm86 bit around everywhere.
++			 */
++			if (v8086_mode(regs))
++				m->cs |= 3;
+ 		}
+ 		/* Use accurate RIP reporting if available. */
+ 		if (rip_msr)
+diff --git a/arch/x86/kernel/cpu/perf_event_amd.c b/arch/x86/kernel/cpu/perf_event_amd.c
+index 95e7fe1..9edc786 100644
+--- a/arch/x86/kernel/cpu/perf_event_amd.c
++++ b/arch/x86/kernel/cpu/perf_event_amd.c
+@@ -493,6 +493,7 @@ static __initconst const struct x86_pmu amd_pmu = {
+  * 0x023	DE	PERF_CTL[2:0]
+  * 0x02D	LS	PERF_CTL[3]
+  * 0x02E	LS	PERF_CTL[3,0]
++ * 0x031	LS	PERF_CTL[2:0] (**)
+  * 0x043	CU	PERF_CTL[2:0]
+  * 0x045	CU	PERF_CTL[2:0]
+  * 0x046	CU	PERF_CTL[2:0]
+@@ -506,10 +507,12 @@ static __initconst const struct x86_pmu amd_pmu = {
+  * 0x0DD	LS	PERF_CTL[5:0]
+  * 0x0DE	LS	PERF_CTL[5:0]
+  * 0x0DF	LS	PERF_CTL[5:0]
++ * 0x1C0	EX	PERF_CTL[5:3]
+  * 0x1D6	EX	PERF_CTL[5:0]
+  * 0x1D8	EX	PERF_CTL[5:0]
+  *
+- * (*) depending on the umask all FPU counters may be used
++ * (*)  depending on the umask all FPU counters may be used
++ * (**) only one unitmask enabled at a time
+  */
+ 
+ static struct event_constraint amd_f15_PMC0  = EVENT_CONSTRAINT(0, 0x01, 0);
+@@ -559,6 +562,12 @@ amd_get_event_constraints_f15h(struct cpu_hw_events *cpuc, struct perf_event *ev
+ 			return &amd_f15_PMC3;
+ 		case 0x02E:
+ 			return &amd_f15_PMC30;
++		case 0x031:
++			if (hweight_long(hwc->config & ARCH_PERFMON_EVENTSEL_UMASK) <= 1)
++				return &amd_f15_PMC20;
++			return &emptyconstraint;
++		case 0x1C0:
++			return &amd_f15_PMC53;
+ 		default:
+ 			return &amd_f15_PMC50;
+ 		}
+diff --git a/arch/x86/pci/xen.c b/arch/x86/pci/xen.c
+index 7415aa9..56ab749 100644
+--- a/arch/x86/pci/xen.c
++++ b/arch/x86/pci/xen.c
+@@ -64,6 +64,10 @@ static int xen_register_pirq(u32 gsi, int gsi_override, int triggering,
+ 	int shareable = 0;
+ 	char *name;
+ 
++	irq = xen_irq_from_gsi(gsi);
++	if (irq > 0)
++		return irq;
++
+ 	if (set_pirq)
+ 		pirq = gsi;
+ 
+diff --git a/arch/x86/tools/relocs.c b/arch/x86/tools/relocs.c
+index b43cfcd..b685296 100644
+--- a/arch/x86/tools/relocs.c
++++ b/arch/x86/tools/relocs.c
+@@ -60,6 +60,18 @@ static const char * const sym_regex_kernel[S_NSYMTYPES] = {
+ 	"__x86_cpu_dev_(start|end)|"
+ 	"(__parainstructions|__alt_instructions)(|_end)|"
+ 	"(__iommu_table|__apicdrivers|__smp_locks)(|_end)|"
++	"__(start|end)_pci_.*|"
++	"__(start|end)_builtin_fw|"
++	"__(start|stop)___ksymtab(|_gpl|_unused|_unused_gpl|_gpl_future)|"
++	"__(start|stop)___kcrctab(|_gpl|_unused|_unused_gpl|_gpl_future)|"
++	"__(start|stop)___param|"
++	"__(start|stop)___modver|"
++	"__(start|stop)___bug_table|"
++	"__tracedata_(start|end)|"
++	"__(start|stop)_notes|"
++	"__end_rodata|"
++	"__initramfs_start|"
++	"(jiffies|jiffies_64)|"
+ 	"_end)$"
+ };
+ 
+diff --git a/drivers/gpio/gpio-mpc8xxx.c b/drivers/gpio/gpio-mpc8xxx.c
+index e6568c1..5a1817e 100644
+--- a/drivers/gpio/gpio-mpc8xxx.c
++++ b/drivers/gpio/gpio-mpc8xxx.c
+@@ -163,7 +163,8 @@ static void mpc8xxx_gpio_irq_cascade(unsigned int irq, struct irq_desc *desc)
+ 	if (mask)
+ 		generic_handle_irq(irq_linear_revmap(mpc8xxx_gc->irq,
+ 						     32 - ffs(mask)));
+-	chip->irq_eoi(&desc->irq_data);
++	if (chip->irq_eoi)
++		chip->irq_eoi(&desc->irq_data);
+ }
+ 
+ static void mpc8xxx_irq_unmask(struct irq_data *d)
+diff --git a/drivers/gpu/drm/gma500/psb_device.c b/drivers/gpu/drm/gma500/psb_device.c
+index 95d163e..328a193 100644
+--- a/drivers/gpu/drm/gma500/psb_device.c
++++ b/drivers/gpu/drm/gma500/psb_device.c
+@@ -197,7 +197,8 @@ static int psb_save_display_registers(struct drm_device *dev)
+ 	}
+ 
+ 	list_for_each_entry(connector, &dev->mode_config.connector_list, head)
+-		connector->funcs->save(connector);
++		if (connector->funcs->save)
++			connector->funcs->save(connector);
+ 
+ 	mutex_unlock(&dev->mode_config.mutex);
+ 	return 0;
+@@ -235,7 +236,8 @@ static int psb_restore_display_registers(struct drm_device *dev)
+ 			crtc->funcs->restore(crtc);
+ 
+ 	list_for_each_entry(connector, &dev->mode_config.connector_list, head)
+-		connector->funcs->restore(connector);
++		if (connector->funcs->restore)
++			connector->funcs->restore(connector);
+ 
+ 	mutex_unlock(&dev->mode_config.mutex);
+ 	return 0;
+diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
+index afd4e03..f57e5cf 100644
+--- a/drivers/gpu/drm/i915/i915_irq.c
++++ b/drivers/gpu/drm/i915/i915_irq.c
+@@ -424,14 +424,11 @@ static void gen6_pm_rps_work(struct work_struct *work)
+ 	mutex_unlock(&dev_priv->dev->struct_mutex);
+ }
+ 
+-static void pch_irq_handler(struct drm_device *dev)
++static void pch_irq_handler(struct drm_device *dev, u32 pch_iir)
+ {
+ 	drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+-	u32 pch_iir;
+ 	int pipe;
+ 
+-	pch_iir = I915_READ(SDEIIR);
+-
+ 	if (pch_iir & SDE_AUDIO_POWER_MASK)
+ 		DRM_DEBUG_DRIVER("PCH audio power change on port %d\n",
+ 				 (pch_iir & SDE_AUDIO_POWER_MASK) >>
+@@ -529,7 +526,7 @@ static irqreturn_t ivybridge_irq_handler(DRM_IRQ_ARGS)
+ 	if (de_iir & DE_PCH_EVENT_IVB) {
+ 		if (pch_iir & SDE_HOTPLUG_MASK_CPT)
+ 			queue_work(dev_priv->wq, &dev_priv->hotplug_work);
+-		pch_irq_handler(dev);
++		pch_irq_handler(dev, pch_iir);
+ 	}
+ 
+ 	if (pm_iir & GEN6_PM_DEFERRED_EVENTS) {
+@@ -629,7 +626,7 @@ static irqreturn_t ironlake_irq_handler(DRM_IRQ_ARGS)
+ 	if (de_iir & DE_PCH_EVENT) {
+ 		if (pch_iir & hotplug_mask)
+ 			queue_work(dev_priv->wq, &dev_priv->hotplug_work);
+-		pch_irq_handler(dev);
++		pch_irq_handler(dev, pch_iir);
+ 	}
+ 
+ 	if (de_iir & DE_PCU_EVENT) {
+diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
+index 9d24d65..29bfd89 100644
+--- a/drivers/gpu/drm/i915/i915_reg.h
++++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -615,6 +615,21 @@
+ 
+ #define GEN6_BSD_RNCID			0x12198
+ 
++#define GEN7_FF_THREAD_MODE		0x20a0
++#define   GEN7_FF_SCHED_MASK		0x0077070
++#define   GEN7_FF_TS_SCHED_HS1		(0x5<<16)
++#define   GEN7_FF_TS_SCHED_HS0		(0x3<<16)
++#define   GEN7_FF_TS_SCHED_LOAD_BALANCE	(0x1<<16)
++#define   GEN7_FF_TS_SCHED_HW		(0x0<<16) /* Default */
++#define   GEN7_FF_VS_SCHED_HS1		(0x5<<12)
++#define   GEN7_FF_VS_SCHED_HS0		(0x3<<12)
++#define   GEN7_FF_VS_SCHED_LOAD_BALANCE	(0x1<<12) /* Default */
++#define   GEN7_FF_VS_SCHED_HW		(0x0<<12)
++#define   GEN7_FF_DS_SCHED_HS1		(0x5<<4)
++#define   GEN7_FF_DS_SCHED_HS0		(0x3<<4)
++#define   GEN7_FF_DS_SCHED_LOAD_BALANCE	(0x1<<4)  /* Default */
++#define   GEN7_FF_DS_SCHED_HW		(0x0<<4)
++
+ /*
+  * Framebuffer compression (915+ only)
+  */
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index 1b1cf3b..79a7de1 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -7617,10 +7617,11 @@ static void intel_sanitize_modesetting(struct drm_device *dev,
+ {
+ 	struct drm_i915_private *dev_priv = dev->dev_private;
+ 	u32 reg, val;
++	int i;
+ 
+ 	/* Clear any frame start delays used for debugging left by the BIOS */
+-	for_each_pipe(pipe) {
+-		reg = PIPECONF(pipe);
++	for_each_pipe(i) {
++		reg = PIPECONF(i);
+ 		I915_WRITE(reg, I915_READ(reg) & ~PIPECONF_FRAME_START_DELAY_MASK);
+ 	}
+ 
+@@ -8612,6 +8613,18 @@ static void gen6_init_clock_gating(struct drm_device *dev)
+ 	}
+ }
+ 
++static void gen7_setup_fixed_func_scheduler(struct drm_i915_private *dev_priv)
++{
++	uint32_t reg = I915_READ(GEN7_FF_THREAD_MODE);
++
++	reg &= ~GEN7_FF_SCHED_MASK;
++	reg |= GEN7_FF_TS_SCHED_HW;
++	reg |= GEN7_FF_VS_SCHED_HW;
++	reg |= GEN7_FF_DS_SCHED_HW;
++
++	I915_WRITE(GEN7_FF_THREAD_MODE, reg);
++}
++
+ static void ivybridge_init_clock_gating(struct drm_device *dev)
+ {
+ 	struct drm_i915_private *dev_priv = dev->dev_private;
+@@ -8656,6 +8669,8 @@ static void ivybridge_init_clock_gating(struct drm_device *dev)
+ 			   DISPPLANE_TRICKLE_FEED_DISABLE);
+ 		intel_flush_display_plane(dev_priv, pipe);
+ 	}
++
++	gen7_setup_fixed_func_scheduler(dev_priv);
+ }
+ 
+ static void g4x_init_clock_gating(struct drm_device *dev)
+diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c
+index 7d15a77..12ce044 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
++++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
+@@ -1030,7 +1030,7 @@ nouveau_ttm_fault_reserve_notify(struct ttm_buffer_object *bo)
+ 
+ 	nvbo->placement.fpfn = 0;
+ 	nvbo->placement.lpfn = dev_priv->fb_mappable_pages;
+-	nouveau_bo_placement_set(nvbo, TTM_PL_VRAM, 0);
++	nouveau_bo_placement_set(nvbo, TTM_PL_FLAG_VRAM, 0);
+ 	return nouveau_bo_validate(nvbo, false, true, false);
+ }
+ 
+diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
+index 2b56efc..d44ea58 100644
+--- a/drivers/hid/hid-logitech-dj.c
++++ b/drivers/hid/hid-logitech-dj.c
+@@ -26,6 +26,7 @@
+ #include <linux/hid.h>
+ #include <linux/module.h>
+ #include <linux/usb.h>
++#include <asm/unaligned.h>
+ #include "usbhid/usbhid.h"
+ #include "hid-ids.h"
+ #include "hid-logitech-dj.h"
+@@ -265,8 +266,8 @@ static void logi_dj_recv_add_djhid_device(struct dj_receiver_dev *djrcv_dev,
+ 		goto dj_device_allocate_fail;
+ 	}
+ 
+-	dj_dev->reports_supported = le32_to_cpu(
+-		dj_report->report_params[DEVICE_PAIRED_RF_REPORT_TYPE]);
++	dj_dev->reports_supported = get_unaligned_le32(
++		dj_report->report_params + DEVICE_PAIRED_RF_REPORT_TYPE);
+ 	dj_dev->hdev = dj_hiddev;
+ 	dj_dev->dj_receiver_dev = djrcv_dev;
+ 	dj_dev->device_index = dj_report->device_index;
+diff --git a/drivers/hid/hid-wiimote-core.c b/drivers/hid/hid-wiimote-core.c
+index cac3589..84e2fbe 100644
+--- a/drivers/hid/hid-wiimote-core.c
++++ b/drivers/hid/hid-wiimote-core.c
+@@ -769,7 +769,7 @@ static void __ir_to_input(struct wiimote_data *wdata, const __u8 *ir,
+ 
+ 	/*
+ 	 * Basic IR data is encoded into 3 bytes. The first two bytes are the
+-	 * upper 8 bit of the X/Y data, the 3rd byte contains the lower 2 bits
++	 * lower 8 bit of the X/Y data, the 3rd byte contains the upper 2 bits
+ 	 * of both.
+ 	 * If data is packed, then the 3rd byte is put first and slightly
+ 	 * reordered. This allows to interleave packed and non-packed data to
+@@ -778,17 +778,11 @@ static void __ir_to_input(struct wiimote_data *wdata, const __u8 *ir,
+ 	 */
+ 
+ 	if (packed) {
+-		x = ir[1] << 2;
+-		y = ir[2] << 2;
+-
+-		x |= ir[0] & 0x3;
+-		y |= (ir[0] >> 2) & 0x3;
++		x = ir[1] | ((ir[0] & 0x03) << 8);
++		y = ir[2] | ((ir[0] & 0x0c) << 6);
+ 	} else {
+-		x = ir[0] << 2;
+-		y = ir[1] << 2;
+-
+-		x |= (ir[2] >> 4) & 0x3;
+-		y |= (ir[2] >> 6) & 0x3;
++		x = ir[0] | ((ir[2] & 0x30) << 4);
++		y = ir[1] | ((ir[2] & 0xc0) << 2);
+ 	}
+ 
+ 	input_report_abs(wdata->ir, xid, x);
+diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
+index 5bf91db..4bbb883 100644
+--- a/drivers/hid/usbhid/hid-core.c
++++ b/drivers/hid/usbhid/hid-core.c
+@@ -399,6 +399,16 @@ static int hid_submit_ctrl(struct hid_device *hid)
+  * Output interrupt completion handler.
+  */
+ 
++static int irq_out_pump_restart(struct hid_device *hid)
++{
++	struct usbhid_device *usbhid = hid->driver_data;
++
++	if (usbhid->outhead != usbhid->outtail)
++		return hid_submit_out(hid);
++	else
++		return -1;
++}
++
+ static void hid_irq_out(struct urb *urb)
+ {
+ 	struct hid_device *hid = urb->context;
+@@ -428,7 +438,7 @@ static void hid_irq_out(struct urb *urb)
+ 	else
+ 		usbhid->outtail = (usbhid->outtail + 1) & (HID_OUTPUT_FIFO_SIZE - 1);
+ 
+-	if (usbhid->outhead != usbhid->outtail && !hid_submit_out(hid)) {
++	if (!irq_out_pump_restart(hid)) {
+ 		/* Successfully submitted next urb in queue */
+ 		spin_unlock_irqrestore(&usbhid->lock, flags);
+ 		return;
+@@ -443,6 +453,15 @@ static void hid_irq_out(struct urb *urb)
+ /*
+  * Control pipe completion handler.
+  */
++static int ctrl_pump_restart(struct hid_device *hid)
++{
++	struct usbhid_device *usbhid = hid->driver_data;
++
++	if (usbhid->ctrlhead != usbhid->ctrltail)
++		return hid_submit_ctrl(hid);
++	else
++		return -1;
++}
+ 
+ static void hid_ctrl(struct urb *urb)
+ {
+@@ -476,7 +495,7 @@ static void hid_ctrl(struct urb *urb)
+ 	else
+ 		usbhid->ctrltail = (usbhid->ctrltail + 1) & (HID_CONTROL_FIFO_SIZE - 1);
+ 
+-	if (usbhid->ctrlhead != usbhid->ctrltail && !hid_submit_ctrl(hid)) {
++	if (!ctrl_pump_restart(hid)) {
+ 		/* Successfully submitted next urb in queue */
+ 		spin_unlock(&usbhid->lock);
+ 		return;
+@@ -535,11 +554,27 @@ static void __usbhid_submit_report(struct hid_device *hid, struct hid_report *re
+ 			 * the queue is known to run
+ 			 * but an earlier request may be stuck
+ 			 * we may need to time out
+-			 * no race because this is called under
++			 * no race because the URB is blocked under
+ 			 * spinlock
+ 			 */
+-			if (time_after(jiffies, usbhid->last_out + HZ * 5))
++			if (time_after(jiffies, usbhid->last_out + HZ * 5)) {
++				usb_block_urb(usbhid->urbout);
++				/* drop lock to not deadlock if the callback is called */
++				spin_unlock(&usbhid->lock);
+ 				usb_unlink_urb(usbhid->urbout);
++				spin_lock(&usbhid->lock);
++				usb_unblock_urb(usbhid->urbout);
++				/*
++				 * if the unlinking has already completed
++				 * the pump will have been stopped
++				 * it must be restarted now
++				 */
++				if (!test_bit(HID_OUT_RUNNING, &usbhid->iofl))
++					if (!irq_out_pump_restart(hid))
++						set_bit(HID_OUT_RUNNING, &usbhid->iofl);
++
++
++			}
+ 		}
+ 		return;
+ 	}
+@@ -583,11 +618,25 @@ static void __usbhid_submit_report(struct hid_device *hid, struct hid_report *re
+ 		 * the queue is known to run
+ 		 * but an earlier request may be stuck
+ 		 * we may need to time out
+-		 * no race because this is called under
++		 * no race because the URB is blocked under
+ 		 * spinlock
+ 		 */
+-		if (time_after(jiffies, usbhid->last_ctrl + HZ * 5))
++		if (time_after(jiffies, usbhid->last_ctrl + HZ * 5)) {
++			usb_block_urb(usbhid->urbctrl);
++			/* drop lock to not deadlock if the callback is called */
++			spin_unlock(&usbhid->lock);
+ 			usb_unlink_urb(usbhid->urbctrl);
++			spin_lock(&usbhid->lock);
++			usb_unblock_urb(usbhid->urbctrl);
++			/*
++			 * if the unlinking has already completed
++			 * the pump will have been stopped
++			 * it must be restarted now
++			 */
++			if (!test_bit(HID_CTRL_RUNNING, &usbhid->iofl))
++				if (!ctrl_pump_restart(hid))
++					set_bit(HID_CTRL_RUNNING, &usbhid->iofl);
++		}
+ 	}
+ }
+ 
+diff --git a/drivers/i2c/busses/i2c-davinci.c b/drivers/i2c/busses/i2c-davinci.c
+index a76d85f..79b4bcb 100644
+--- a/drivers/i2c/busses/i2c-davinci.c
++++ b/drivers/i2c/busses/i2c-davinci.c
+@@ -755,7 +755,7 @@ static int davinci_i2c_remove(struct platform_device *pdev)
+ 	dev->clk = NULL;
+ 
+ 	davinci_i2c_write_reg(dev, DAVINCI_I2C_MDR_REG, 0);
+-	free_irq(IRQ_I2C, dev);
++	free_irq(dev->irq, dev);
+ 	iounmap(dev->base);
+ 	kfree(dev);
+ 
+diff --git a/drivers/i2c/busses/i2c-tegra.c b/drivers/i2c/busses/i2c-tegra.c
+index 55e5ea6..df19f3d 100644
+--- a/drivers/i2c/busses/i2c-tegra.c
++++ b/drivers/i2c/busses/i2c-tegra.c
+@@ -401,8 +401,6 @@ static irqreturn_t tegra_i2c_isr(int irq, void *dev_id)
+ 			disable_irq_nosync(i2c_dev->irq);
+ 			i2c_dev->irq_disabled = 1;
+ 		}
+-
+-		complete(&i2c_dev->msg_complete);
+ 		goto err;
+ 	}
+ 
+@@ -411,7 +409,6 @@ static irqreturn_t tegra_i2c_isr(int irq, void *dev_id)
+ 			i2c_dev->msg_err |= I2C_ERR_NO_ACK;
+ 		if (status & I2C_INT_ARBITRATION_LOST)
+ 			i2c_dev->msg_err |= I2C_ERR_ARBITRATION_LOST;
+-		complete(&i2c_dev->msg_complete);
+ 		goto err;
+ 	}
+ 
+@@ -429,14 +426,14 @@ static irqreturn_t tegra_i2c_isr(int irq, void *dev_id)
+ 			tegra_i2c_mask_irq(i2c_dev, I2C_INT_TX_FIFO_DATA_REQ);
+ 	}
+ 
++	i2c_writel(i2c_dev, status, I2C_INT_STATUS);
++	if (i2c_dev->is_dvc)
++		dvc_writel(i2c_dev, DVC_STATUS_I2C_DONE_INTR, DVC_STATUS);
++
+ 	if (status & I2C_INT_PACKET_XFER_COMPLETE) {
+ 		BUG_ON(i2c_dev->msg_buf_remaining);
+ 		complete(&i2c_dev->msg_complete);
+ 	}
+-
+-	i2c_writel(i2c_dev, status, I2C_INT_STATUS);
+-	if (i2c_dev->is_dvc)
+-		dvc_writel(i2c_dev, DVC_STATUS_I2C_DONE_INTR, DVC_STATUS);
+ 	return IRQ_HANDLED;
+ err:
+ 	/* An error occurred, mask all interrupts */
+@@ -446,6 +443,8 @@ err:
+ 	i2c_writel(i2c_dev, status, I2C_INT_STATUS);
+ 	if (i2c_dev->is_dvc)
+ 		dvc_writel(i2c_dev, DVC_STATUS_I2C_DONE_INTR, DVC_STATUS);
++
++	complete(&i2c_dev->msg_complete);
+ 	return IRQ_HANDLED;
+ }
+ 
+diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
+index 71f0c0f..a841123 100644
+--- a/drivers/infiniband/core/umem.c
++++ b/drivers/infiniband/core/umem.c
+@@ -269,7 +269,7 @@ void ib_umem_release(struct ib_umem *umem)
+ 	} else
+ 		down_write(&mm->mmap_sem);
+ 
+-	current->mm->locked_vm -= diff;
++	current->mm->pinned_vm -= diff;
+ 	up_write(&mm->mmap_sem);
+ 	mmput(mm);
+ 	kfree(umem);
+diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
+index 92b4c2b..4c7c62f 100644
+--- a/drivers/infiniband/hw/cxgb4/cm.c
++++ b/drivers/infiniband/hw/cxgb4/cm.c
+@@ -1593,7 +1593,7 @@ static int import_ep(struct c4iw_ep *ep, __be32 peer_ip, struct dst_entry *dst,
+ 					n, n->dev, 0);
+ 		if (!ep->l2t)
+ 			goto out;
+-		ep->mtu = dst_mtu(ep->dst);
++		ep->mtu = dst_mtu(dst);
+ 		ep->tx_chan = cxgb4_port_chan(n->dev);
+ 		ep->smac_idx = (cxgb4_port_viid(n->dev) & 0x7F) << 1;
+ 		step = cdev->rdev.lldi.ntxq /
+@@ -2656,6 +2656,12 @@ static int peer_abort_intr(struct c4iw_dev *dev, struct sk_buff *skb)
+ 	unsigned int tid = GET_TID(req);
+ 
+ 	ep = lookup_tid(t, tid);
++	if (!ep) {
++		printk(KERN_WARNING MOD
++		       "Abort on non-existent endpoint, tid %d\n", tid);
++		kfree_skb(skb);
++		return 0;
++	}
+ 	if (is_neg_adv_abort(req->status)) {
+ 		PDBG("%s neg_adv_abort ep %p tid %u\n", __func__, ep,
+ 		     ep->hwtid);
+@@ -2667,11 +2673,8 @@ static int peer_abort_intr(struct c4iw_dev *dev, struct sk_buff *skb)
+ 
+ 	/*
+ 	 * Wake up any threads in rdma_init() or rdma_fini().
+-	 * However, this is not needed if com state is just
+-	 * MPA_REQ_SENT
+ 	 */
+-	if (ep->com.state != MPA_REQ_SENT)
+-		c4iw_wake_up(&ep->com.wr_wait, -ECONNRESET);
++	c4iw_wake_up(&ep->com.wr_wait, -ECONNRESET);
+ 	sched(dev, skb);
+ 	return 0;
+ }
+diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
+index 35c1e17..97b2e21 100644
+--- a/drivers/iommu/dmar.c
++++ b/drivers/iommu/dmar.c
+@@ -1056,8 +1056,8 @@ static const char *intr_remap_fault_reasons[] =
+ 
+ const char *dmar_get_fault_reason(u8 fault_reason, int *fault_type)
+ {
+-	if (fault_reason >= 0x20 && (fault_reason <= 0x20 +
+-				     ARRAY_SIZE(intr_remap_fault_reasons))) {
++	if (fault_reason >= 0x20 && (fault_reason - 0x20 <
++					ARRAY_SIZE(intr_remap_fault_reasons))) {
+ 		*fault_type = INTR_REMAP;
+ 		return intr_remap_fault_reasons[fault_reason - 0x20];
+ 	} else if (fault_reason < ARRAY_SIZE(dma_remap_fault_reasons)) {
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index f93d5ac..5fda348 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -2286,12 +2286,6 @@ static int domain_add_dev_info(struct dmar_domain *domain,
+ 	if (!info)
+ 		return -ENOMEM;
+ 
+-	ret = domain_context_mapping(domain, pdev, translation);
+-	if (ret) {
+-		free_devinfo_mem(info);
+-		return ret;
+-	}
+-
+ 	info->segment = pci_domain_nr(pdev->bus);
+ 	info->bus = pdev->bus->number;
+ 	info->devfn = pdev->devfn;
+@@ -2304,6 +2298,17 @@ static int domain_add_dev_info(struct dmar_domain *domain,
+ 	pdev->dev.archdata.iommu = info;
+ 	spin_unlock_irqrestore(&device_domain_lock, flags);
+ 
++	ret = domain_context_mapping(domain, pdev, translation);
++	if (ret) {
++		spin_lock_irqsave(&device_domain_lock, flags);
++		list_del(&info->link);
++		list_del(&info->global);
++		pdev->dev.archdata.iommu = NULL;
++		spin_unlock_irqrestore(&device_domain_lock, flags);
++		free_devinfo_mem(info);
++		return ret;
++	}
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/isdn/gigaset/capi.c b/drivers/isdn/gigaset/capi.c
+index 343b5c8..579aa02 100644
+--- a/drivers/isdn/gigaset/capi.c
++++ b/drivers/isdn/gigaset/capi.c
+@@ -14,6 +14,7 @@
+ #include "gigaset.h"
+ #include <linux/proc_fs.h>
+ #include <linux/seq_file.h>
++#include <linux/ratelimit.h>
+ #include <linux/isdn/capilli.h>
+ #include <linux/isdn/capicmd.h>
+ #include <linux/isdn/capiutil.h>
+@@ -223,10 +224,14 @@ get_appl(struct gigaset_capi_ctr *iif, u16 appl)
+ static inline void dump_cmsg(enum debuglevel level, const char *tag, _cmsg *p)
+ {
+ #ifdef CONFIG_GIGASET_DEBUG
++	/* dump at most 20 messages in 20 secs */
++	static DEFINE_RATELIMIT_STATE(msg_dump_ratelimit, 20 * HZ, 20);
+ 	_cdebbuf *cdb;
+ 
+ 	if (!(gigaset_debuglevel & level))
+ 		return;
++	if (!___ratelimit(&msg_dump_ratelimit, tag))
++		return;
+ 
+ 	cdb = capi_cmsg2str(p);
+ 	if (cdb) {
+@@ -1882,6 +1887,9 @@ static void do_disconnect_req(struct gigaset_capi_ctr *iif,
+ 
+ 	/* check for active logical connection */
+ 	if (bcs->apconnstate >= APCONN_ACTIVE) {
++		/* clear it */
++		bcs->apconnstate = APCONN_SETUP;
++
+ 		/*
+ 		 * emit DISCONNECT_B3_IND with cause 0x3301
+ 		 * use separate cmsg structure, as the content of iif->acmsg
+@@ -1906,6 +1914,7 @@ static void do_disconnect_req(struct gigaset_capi_ctr *iif,
+ 		}
+ 		capi_cmsg2message(b3cmsg,
+ 				  __skb_put(b3skb, CAPI_DISCONNECT_B3_IND_BASELEN));
++		dump_cmsg(DEBUG_CMD, __func__, b3cmsg);
+ 		kfree(b3cmsg);
+ 		capi_ctr_handle_message(&iif->ctr, ap->id, b3skb);
+ 	}
+@@ -2059,12 +2068,6 @@ static void do_reset_b3_req(struct gigaset_capi_ctr *iif,
+ }
+ 
+ /*
+- * dump unsupported/ignored messages at most twice per minute,
+- * some apps send those very frequently
+- */
+-static unsigned long ignored_msg_dump_time;
+-
+-/*
+  * unsupported CAPI message handler
+  */
+ static void do_unsupported(struct gigaset_capi_ctr *iif,
+@@ -2073,8 +2076,7 @@ static void do_unsupported(struct gigaset_capi_ctr *iif,
+ {
+ 	/* decode message */
+ 	capi_message2cmsg(&iif->acmsg, skb->data);
+-	if (printk_timed_ratelimit(&ignored_msg_dump_time, 30 * 1000))
+-		dump_cmsg(DEBUG_CMD, __func__, &iif->acmsg);
++	dump_cmsg(DEBUG_CMD, __func__, &iif->acmsg);
+ 	send_conf(iif, ap, skb, CapiMessageNotSupportedInCurrentState);
+ }
+ 
+@@ -2085,11 +2087,9 @@ static void do_nothing(struct gigaset_capi_ctr *iif,
+ 		       struct gigaset_capi_appl *ap,
+ 		       struct sk_buff *skb)
+ {
+-	if (printk_timed_ratelimit(&ignored_msg_dump_time, 30 * 1000)) {
+-		/* decode message */
+-		capi_message2cmsg(&iif->acmsg, skb->data);
+-		dump_cmsg(DEBUG_CMD, __func__, &iif->acmsg);
+-	}
++	/* decode message */
++	capi_message2cmsg(&iif->acmsg, skb->data);
++	dump_cmsg(DEBUG_CMD, __func__, &iif->acmsg);
+ 	dev_kfree_skb_any(skb);
+ }
+ 
+diff --git a/drivers/isdn/gigaset/ev-layer.c b/drivers/isdn/gigaset/ev-layer.c
+index 624a825..685638a 100644
+--- a/drivers/isdn/gigaset/ev-layer.c
++++ b/drivers/isdn/gigaset/ev-layer.c
+@@ -190,6 +190,7 @@ struct reply_t gigaset_tab_nocid[] =
+ 								  ACT_INIT} },
+ 	{RSP_OK,	121, 121, -1,			  0,  0, {ACT_GOTVER,
+ 								  ACT_INIT} },
++	{RSP_NONE,	121, 121, -1,			120,  0, {ACT_GETSTRING} },
+ 
+ /* leave dle mode */
+ 	{RSP_INIT,	  0,   0, SEQ_DLE0,		201,  5, {0},	"^SDLE=0\r"},
+@@ -1314,8 +1315,9 @@ static void do_action(int action, struct cardstate *cs,
+ 		s = ev->ptr;
+ 
+ 		if (!strcmp(s, "OK")) {
++			/* OK without version string: assume old response */
+ 			*p_genresp = 1;
+-			*p_resp_code = RSP_ERROR;
++			*p_resp_code = RSP_NONE;
+ 			break;
+ 		}
+ 
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 01233d8..2b30ffd 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -452,7 +452,7 @@ static void submit_flushes(struct work_struct *ws)
+ 			atomic_inc(&rdev->nr_pending);
+ 			atomic_inc(&rdev->nr_pending);
+ 			rcu_read_unlock();
+-			bi = bio_alloc_mddev(GFP_KERNEL, 0, mddev);
++			bi = bio_alloc_mddev(GFP_NOIO, 0, mddev);
+ 			bi->bi_end_io = md_end_flush;
+ 			bi->bi_private = rdev;
+ 			bi->bi_bdev = rdev->bdev;
+diff --git a/drivers/media/dvb/siano/smsusb.c b/drivers/media/dvb/siano/smsusb.c
+index b1fe513..63c004a 100644
+--- a/drivers/media/dvb/siano/smsusb.c
++++ b/drivers/media/dvb/siano/smsusb.c
+@@ -542,6 +542,8 @@ static const struct usb_device_id smsusb_id_table[] __devinitconst = {
+ 		.driver_info = SMS1XXX_BOARD_HAUPPAUGE_WINDHAM },
+ 	{ USB_DEVICE(0x2040, 0xc090),
+ 		.driver_info = SMS1XXX_BOARD_HAUPPAUGE_WINDHAM },
++	{ USB_DEVICE(0x2040, 0xc0a0),
++		.driver_info = SMS1XXX_BOARD_HAUPPAUGE_WINDHAM },
+ 	{ } /* Terminating entry */
+ 	};
+ 
+diff --git a/drivers/media/video/uvc/uvc_v4l2.c b/drivers/media/video/uvc/uvc_v4l2.c
+index ff2cddd..53ab972 100644
+--- a/drivers/media/video/uvc/uvc_v4l2.c
++++ b/drivers/media/video/uvc/uvc_v4l2.c
+@@ -687,7 +687,7 @@ static long uvc_v4l2_do_ioctl(struct file *file, unsigned int cmd, void *arg)
+ 					break;
+ 			}
+ 			pin = iterm->id;
+-		} else if (pin < selector->bNrInPins) {
++		} else if (index < selector->bNrInPins) {
+ 			pin = selector->baSourceID[index];
+ 			list_for_each_entry(iterm, &chain->entities, chain) {
+ 				if (!UVC_ENTITY_IS_ITERM(iterm))
+diff --git a/drivers/mmc/core/cd-gpio.c b/drivers/mmc/core/cd-gpio.c
+index 2c14be7..f13e38d 100644
+--- a/drivers/mmc/core/cd-gpio.c
++++ b/drivers/mmc/core/cd-gpio.c
+@@ -73,6 +73,9 @@ void mmc_cd_gpio_free(struct mmc_host *host)
+ {
+ 	struct mmc_cd_gpio *cd = host->hotplug.handler_priv;
+ 
++	if (!cd)
++		return;
++
+ 	free_irq(host->hotplug.irq, host);
+ 	gpio_free(cd->gpio);
+ 	kfree(cd);
+diff --git a/drivers/mmc/core/sdio.c b/drivers/mmc/core/sdio.c
+index 2c7c83f..13d0e95 100644
+--- a/drivers/mmc/core/sdio.c
++++ b/drivers/mmc/core/sdio.c
+@@ -947,7 +947,7 @@ static int mmc_sdio_resume(struct mmc_host *host)
+ 	}
+ 
+ 	if (!err && host->sdio_irqs)
+-		mmc_signal_sdio_irq(host);
++		wake_up_process(host->sdio_irq_thread);
+ 	mmc_release_host(host);
+ 
+ 	/*
+diff --git a/drivers/mmc/core/sdio_irq.c b/drivers/mmc/core/sdio_irq.c
+index f573e7f..3d8ceb4 100644
+--- a/drivers/mmc/core/sdio_irq.c
++++ b/drivers/mmc/core/sdio_irq.c
+@@ -28,18 +28,20 @@
+ 
+ #include "sdio_ops.h"
+ 
+-static int process_sdio_pending_irqs(struct mmc_card *card)
++static int process_sdio_pending_irqs(struct mmc_host *host)
+ {
++	struct mmc_card *card = host->card;
+ 	int i, ret, count;
+ 	unsigned char pending;
+ 	struct sdio_func *func;
+ 
+ 	/*
+ 	 * Optimization, if there is only 1 function interrupt registered
+-	 * call irq handler directly
++	 * and we know an IRQ was signaled then call irq handler directly.
++	 * Otherwise do the full probe.
+ 	 */
+ 	func = card->sdio_single_irq;
+-	if (func) {
++	if (func && host->sdio_irq_pending) {
+ 		func->irq_handler(func);
+ 		return 1;
+ 	}
+@@ -116,7 +118,8 @@ static int sdio_irq_thread(void *_host)
+ 		ret = __mmc_claim_host(host, &host->sdio_irq_thread_abort);
+ 		if (ret)
+ 			break;
+-		ret = process_sdio_pending_irqs(host->card);
++		ret = process_sdio_pending_irqs(host);
++		host->sdio_irq_pending = false;
+ 		mmc_release_host(host);
+ 
+ 		/*
+diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
+index 56d4499..71a0c4e 100644
+--- a/drivers/mmc/host/omap_hsmmc.c
++++ b/drivers/mmc/host/omap_hsmmc.c
+@@ -1969,7 +1969,7 @@ static int __devinit omap_hsmmc_probe(struct platform_device *pdev)
+ 		ret = request_threaded_irq(mmc_slot(host).card_detect_irq,
+ 					   NULL,
+ 					   omap_hsmmc_detect,
+-					   IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING,
++					   IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
+ 					   mmc_hostname(mmc), host);
+ 		if (ret) {
+ 			dev_dbg(mmc_dev(host->mmc),
+diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
+index df7e16d..a98db30 100644
+--- a/drivers/net/wireless/b43legacy/main.c
++++ b/drivers/net/wireless/b43legacy/main.c
+@@ -1571,8 +1571,6 @@ static void b43legacy_request_firmware(struct work_struct *work)
+ 	const char *filename;
+ 	int err;
+ 
+-	/* do dummy read */
+-	ssb_read32(dev->dev, SSB_TMSHIGH);
+ 	if (!fw->ucode) {
+ 		if (rev == 2)
+ 			filename = "ucode2";
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index 046fb1b..c18f0fd 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -2971,6 +2971,8 @@ unset_supplies:
+ 	unset_regulator_supplies(rdev);
+ 
+ scrub:
++	if (rdev->supply)
++		regulator_put(rdev->supply);
+ 	kfree(rdev->constraints);
+ 	device_unregister(&rdev->dev);
+ 	/* device core frees rdev */
+diff --git a/drivers/scsi/isci/init.c b/drivers/scsi/isci/init.c
+index 5137db5..bc6cf88 100644
+--- a/drivers/scsi/isci/init.c
++++ b/drivers/scsi/isci/init.c
+@@ -476,7 +476,7 @@ static int __devinit isci_pci_probe(struct pci_dev *pdev, const struct pci_devic
+ 	if (!orom)
+ 		orom = isci_request_oprom(pdev);
+ 
+-	for (i = 0; orom && i < ARRAY_SIZE(orom->ctrl); i++) {
++	for (i = 0; orom && i < num_controllers(pdev); i++) {
+ 		if (sci_oem_parameters_validate(&orom->ctrl[i],
+ 						orom->hdr.version)) {
+ 			dev_warn(&pdev->dev,
+diff --git a/drivers/scsi/mpt2sas/mpt2sas_base.c b/drivers/scsi/mpt2sas/mpt2sas_base.c
+index 8a59a77..1808478 100644
+--- a/drivers/scsi/mpt2sas/mpt2sas_base.c
++++ b/drivers/scsi/mpt2sas/mpt2sas_base.c
+@@ -3343,7 +3343,7 @@ _base_get_port_facts(struct MPT2SAS_ADAPTER *ioc, int port, int sleep_flag)
+ 	}
+ 
+ 	pfacts = &ioc->pfacts[port];
+-	memset(pfacts, 0, sizeof(Mpi2PortFactsReply_t));
++	memset(pfacts, 0, sizeof(struct mpt2sas_port_facts));
+ 	pfacts->PortNumber = mpi_reply.PortNumber;
+ 	pfacts->VP_ID = mpi_reply.VP_ID;
+ 	pfacts->VF_ID = mpi_reply.VF_ID;
+@@ -3385,7 +3385,7 @@ _base_get_ioc_facts(struct MPT2SAS_ADAPTER *ioc, int sleep_flag)
+ 	}
+ 
+ 	facts = &ioc->facts;
+-	memset(facts, 0, sizeof(Mpi2IOCFactsReply_t));
++	memset(facts, 0, sizeof(struct mpt2sas_facts));
+ 	facts->MsgVersion = le16_to_cpu(mpi_reply.MsgVersion);
+ 	facts->HeaderVersion = le16_to_cpu(mpi_reply.HeaderVersion);
+ 	facts->VP_ID = mpi_reply.VP_ID;
+@@ -4262,7 +4262,7 @@ mpt2sas_base_attach(struct MPT2SAS_ADAPTER *ioc)
+ 		goto out_free_resources;
+ 
+ 	ioc->pfacts = kcalloc(ioc->facts.NumberOfPorts,
+-	    sizeof(Mpi2PortFactsReply_t), GFP_KERNEL);
++	    sizeof(struct mpt2sas_port_facts), GFP_KERNEL);
+ 	if (!ioc->pfacts) {
+ 		r = -ENOMEM;
+ 		goto out_free_resources;
+diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c
+index 5f748c0..6a62934 100644
+--- a/drivers/spi/spi-fsl-spi.c
++++ b/drivers/spi/spi-fsl-spi.c
+@@ -933,7 +933,7 @@ err:
+ 
+ static void fsl_spi_cs_control(struct spi_device *spi, bool on)
+ {
+-	struct device *dev = spi->dev.parent;
++	struct device *dev = spi->dev.parent->parent;
+ 	struct mpc8xxx_spi_probe_info *pinfo = to_of_pinfo(dev->platform_data);
+ 	u16 cs = spi->chip_select;
+ 	int gpio = pinfo->gpios[cs];
+diff --git a/drivers/staging/android/persistent_ram.c b/drivers/staging/android/persistent_ram.c
+index 8d8c1e3..3d986ce 100644
+--- a/drivers/staging/android/persistent_ram.c
++++ b/drivers/staging/android/persistent_ram.c
+@@ -79,23 +79,6 @@ static inline void buffer_size_add(struct persistent_ram_zone *prz, size_t a)
+ 	} while (atomic_cmpxchg(&prz->buffer->size, old, new) != old);
+ }
+ 
+-/* increase the size counter, retuning an error if it hits the max size */
+-static inline ssize_t buffer_size_add_clamp(struct persistent_ram_zone *prz,
+-	size_t a)
+-{
+-	size_t old;
+-	size_t new;
+-
+-	do {
+-		old = atomic_read(&prz->buffer->size);
+-		new = old + a;
+-		if (new > prz->buffer_size)
+-			return -ENOMEM;
+-	} while (atomic_cmpxchg(&prz->buffer->size, old, new) != old);
+-
+-	return 0;
+-}
+-
+ static void notrace persistent_ram_encode_rs8(struct persistent_ram_zone *prz,
+ 	uint8_t *data, size_t len, uint8_t *ecc)
+ {
+@@ -300,7 +283,7 @@ int notrace persistent_ram_write(struct persistent_ram_zone *prz,
+ 		c = prz->buffer_size;
+ 	}
+ 
+-	buffer_size_add_clamp(prz, c);
++	buffer_size_add(prz, c);
+ 
+ 	start = buffer_start_add(prz, c);
+ 
+diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c
+index 9bcf87a..a796964 100644
+--- a/drivers/staging/comedi/comedi_fops.c
++++ b/drivers/staging/comedi/comedi_fops.c
+@@ -280,7 +280,7 @@ static int do_devconfig_ioctl(struct comedi_device *dev,
+ 	if (ret == 0) {
+ 		if (!try_module_get(dev->driver->module)) {
+ 			comedi_device_detach(dev);
+-			return -ENOSYS;
++			ret = -ENOSYS;
+ 		}
+ 	}
+ 
+diff --git a/drivers/tty/hvc/hvc_xen.c b/drivers/tty/hvc/hvc_xen.c
+index 83d5c88..d3d91da 100644
+--- a/drivers/tty/hvc/hvc_xen.c
++++ b/drivers/tty/hvc/hvc_xen.c
+@@ -430,9 +430,9 @@ static int __devinit xencons_probe(struct xenbus_device *dev,
+ 	if (devid == 0)
+ 		return -ENODEV;
+ 
+-	info = kzalloc(sizeof(struct xencons_info), GFP_KERNEL | __GFP_ZERO);
++	info = kzalloc(sizeof(struct xencons_info), GFP_KERNEL);
+ 	if (!info)
+-		goto error_nomem;
++		return -ENOMEM;
+ 	dev_set_drvdata(&dev->dev, info);
+ 	info->xbdev = dev;
+ 	info->vtermno = xenbus_devid_to_vtermno(devid);
+diff --git a/drivers/tty/serial/8250/8250.c b/drivers/tty/serial/8250/8250.c
+index 5c27f7e..d537431 100644
+--- a/drivers/tty/serial/8250/8250.c
++++ b/drivers/tty/serial/8250/8250.c
+@@ -2280,10 +2280,11 @@ serial8250_do_set_termios(struct uart_port *port, struct ktermios *termios,
+ 		quot++;
+ 
+ 	if (up->capabilities & UART_CAP_FIFO && port->fifosize > 1) {
+-		if (baud < 2400)
+-			fcr = UART_FCR_ENABLE_FIFO | UART_FCR_TRIGGER_1;
+-		else
+-			fcr = uart_config[port->type].fcr;
++		fcr = uart_config[port->type].fcr;
++		if (baud < 2400) {
++			fcr &= ~UART_FCR_TRIGGER_MASK;
++			fcr |= UART_FCR_TRIGGER_1;
++		}
+ 	}
+ 
+ 	/*
+diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
+index 858dca8..3614973 100644
+--- a/drivers/tty/serial/8250/8250_pci.c
++++ b/drivers/tty/serial/8250/8250_pci.c
+@@ -1609,54 +1609,72 @@ static struct pci_serial_quirk pci_serial_quirks[] __refdata = {
+ 	{
+ 		.vendor         = PCI_VENDOR_ID_INTEL,
+ 		.device         = 0x8811,
++		.subvendor	= PCI_ANY_ID,
++		.subdevice	= PCI_ANY_ID,
+ 		.init		= pci_eg20t_init,
+ 		.setup		= pci_default_setup,
+ 	},
+ 	{
+ 		.vendor         = PCI_VENDOR_ID_INTEL,
+ 		.device         = 0x8812,
++		.subvendor	= PCI_ANY_ID,
++		.subdevice	= PCI_ANY_ID,
+ 		.init		= pci_eg20t_init,
+ 		.setup		= pci_default_setup,
+ 	},
+ 	{
+ 		.vendor         = PCI_VENDOR_ID_INTEL,
+ 		.device         = 0x8813,
++		.subvendor	= PCI_ANY_ID,
++		.subdevice	= PCI_ANY_ID,
+ 		.init		= pci_eg20t_init,
+ 		.setup		= pci_default_setup,
+ 	},
+ 	{
+ 		.vendor         = PCI_VENDOR_ID_INTEL,
+ 		.device         = 0x8814,
++		.subvendor	= PCI_ANY_ID,
++		.subdevice	= PCI_ANY_ID,
+ 		.init		= pci_eg20t_init,
+ 		.setup		= pci_default_setup,
+ 	},
+ 	{
+ 		.vendor         = 0x10DB,
+ 		.device         = 0x8027,
++		.subvendor	= PCI_ANY_ID,
++		.subdevice	= PCI_ANY_ID,
+ 		.init		= pci_eg20t_init,
+ 		.setup		= pci_default_setup,
+ 	},
+ 	{
+ 		.vendor         = 0x10DB,
+ 		.device         = 0x8028,
++		.subvendor	= PCI_ANY_ID,
++		.subdevice	= PCI_ANY_ID,
+ 		.init		= pci_eg20t_init,
+ 		.setup		= pci_default_setup,
+ 	},
+ 	{
+ 		.vendor         = 0x10DB,
+ 		.device         = 0x8029,
++		.subvendor	= PCI_ANY_ID,
++		.subdevice	= PCI_ANY_ID,
+ 		.init		= pci_eg20t_init,
+ 		.setup		= pci_default_setup,
+ 	},
+ 	{
+ 		.vendor         = 0x10DB,
+ 		.device         = 0x800C,
++		.subvendor	= PCI_ANY_ID,
++		.subdevice	= PCI_ANY_ID,
+ 		.init		= pci_eg20t_init,
+ 		.setup		= pci_default_setup,
+ 	},
+ 	{
+ 		.vendor         = 0x10DB,
+ 		.device         = 0x800D,
++		.subvendor	= PCI_ANY_ID,
++		.subdevice	= PCI_ANY_ID,
+ 		.init		= pci_eg20t_init,
+ 		.setup		= pci_default_setup,
+ 	},
+diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c
+index 55fd362..039c054 100644
+--- a/drivers/tty/serial/mxs-auart.c
++++ b/drivers/tty/serial/mxs-auart.c
+@@ -369,6 +369,8 @@ static void mxs_auart_settermios(struct uart_port *u,
+ 
+ 	writel(ctrl, u->membase + AUART_LINECTRL);
+ 	writel(ctrl2, u->membase + AUART_CTRL2);
++
++	uart_update_timeout(u, termios->c_cflag, baud);
+ }
+ 
+ static irqreturn_t mxs_auart_irq_handle(int irq, void *context)
+diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
+index 9c4c05b..246b823 100644
+--- a/drivers/tty/serial/serial_core.c
++++ b/drivers/tty/serial/serial_core.c
+@@ -2282,6 +2282,7 @@ void uart_unregister_driver(struct uart_driver *drv)
+ 	tty_unregister_driver(p);
+ 	put_tty_driver(p);
+ 	kfree(drv->state);
++	drv->state = NULL;
+ 	drv->tty_driver = NULL;
+ }
+ 
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index 0bb2b32..4c8321e 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -309,9 +309,6 @@ static void free_urbs(struct wdm_device *desc)
+ 
+ static void cleanup(struct wdm_device *desc)
+ {
+-	spin_lock(&wdm_device_list_lock);
+-	list_del(&desc->device_list);
+-	spin_unlock(&wdm_device_list_lock);
+ 	kfree(desc->sbuf);
+ 	kfree(desc->inbuf);
+ 	kfree(desc->orq);
+@@ -530,11 +527,13 @@ static int wdm_flush(struct file *file, fl_owner_t id)
+ 	struct wdm_device *desc = file->private_data;
+ 
+ 	wait_event(desc->wait, !test_bit(WDM_IN_USE, &desc->flags));
+-	if (desc->werr < 0)
++
++	/* cannot dereference desc->intf if WDM_DISCONNECTING */
++	if (desc->werr < 0 && !test_bit(WDM_DISCONNECTING, &desc->flags))
+ 		dev_err(&desc->intf->dev, "Error in flush path: %d\n",
+ 			desc->werr);
+ 
+-	return desc->werr;
++	return usb_translate_errors(desc->werr);
+ }
+ 
+ static unsigned int wdm_poll(struct file *file, struct poll_table_struct *wait)
+@@ -545,7 +544,7 @@ static unsigned int wdm_poll(struct file *file, struct poll_table_struct *wait)
+ 
+ 	spin_lock_irqsave(&desc->iuspin, flags);
+ 	if (test_bit(WDM_DISCONNECTING, &desc->flags)) {
+-		mask = POLLERR;
++		mask = POLLHUP | POLLERR;
+ 		spin_unlock_irqrestore(&desc->iuspin, flags);
+ 		goto desc_out;
+ 	}
+@@ -621,10 +620,15 @@ static int wdm_release(struct inode *inode, struct file *file)
+ 	mutex_unlock(&desc->wlock);
+ 
+ 	if (!desc->count) {
+-		dev_dbg(&desc->intf->dev, "wdm_release: cleanup");
+-		kill_urbs(desc);
+-		if (!test_bit(WDM_DISCONNECTING, &desc->flags))
++		if (!test_bit(WDM_DISCONNECTING, &desc->flags)) {
++			dev_dbg(&desc->intf->dev, "wdm_release: cleanup");
++			kill_urbs(desc);
+ 			desc->manage_power(desc->intf, 0);
++		} else {
++			/* must avoid dev_printk here as desc->intf is invalid */
++			pr_debug(KBUILD_MODNAME " %s: device gone - cleaning up\n", __func__);
++			cleanup(desc);
++		}
+ 	}
+ 	mutex_unlock(&wdm_mutex);
+ 	return 0;
+@@ -771,6 +775,9 @@ static int wdm_create(struct usb_interface *intf, struct usb_endpoint_descriptor
+ out:
+ 	return rv;
+ err:
++	spin_lock(&wdm_device_list_lock);
++	list_del(&desc->device_list);
++	spin_unlock(&wdm_device_list_lock);
+ 	cleanup(desc);
+ 	return rv;
+ }
+@@ -896,6 +903,12 @@ static void wdm_disconnect(struct usb_interface *intf)
+ 	cancel_work_sync(&desc->rxwork);
+ 	mutex_unlock(&desc->wlock);
+ 	mutex_unlock(&desc->rlock);
++
++	/* the desc->intf pointer used as list key is now invalid */
++	spin_lock(&wdm_device_list_lock);
++	list_del(&desc->device_list);
++	spin_unlock(&wdm_device_list_lock);
++
+ 	if (!desc->count)
+ 		cleanup(desc);
+ 	mutex_unlock(&wdm_mutex);
+diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
+index 8df4b76..4e57772 100644
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -333,17 +333,14 @@ static struct async *async_getcompleted(struct dev_state *ps)
+ static struct async *async_getpending(struct dev_state *ps,
+ 					     void __user *userurb)
+ {
+-	unsigned long flags;
+ 	struct async *as;
+ 
+-	spin_lock_irqsave(&ps->lock, flags);
+ 	list_for_each_entry(as, &ps->async_pending, asynclist)
+ 		if (as->userurb == userurb) {
+ 			list_del_init(&as->asynclist);
+-			spin_unlock_irqrestore(&ps->lock, flags);
+ 			return as;
+ 		}
+-	spin_unlock_irqrestore(&ps->lock, flags);
++
+ 	return NULL;
+ }
+ 
+@@ -398,6 +395,7 @@ static void cancel_bulk_urbs(struct dev_state *ps, unsigned bulk_addr)
+ __releases(ps->lock)
+ __acquires(ps->lock)
+ {
++	struct urb *urb;
+ 	struct async *as;
+ 
+ 	/* Mark all the pending URBs that match bulk_addr, up to but not
+@@ -420,8 +418,11 @@ __acquires(ps->lock)
+ 	list_for_each_entry(as, &ps->async_pending, asynclist) {
+ 		if (as->bulk_status == AS_UNLINK) {
+ 			as->bulk_status = 0;		/* Only once */
++			urb = as->urb;
++			usb_get_urb(urb);
+ 			spin_unlock(&ps->lock);		/* Allow completions */
+-			usb_unlink_urb(as->urb);
++			usb_unlink_urb(urb);
++			usb_put_urb(urb);
+ 			spin_lock(&ps->lock);
+ 			goto rescan;
+ 		}
+@@ -472,6 +473,7 @@ static void async_completed(struct urb *urb)
+ 
+ static void destroy_async(struct dev_state *ps, struct list_head *list)
+ {
++	struct urb *urb;
+ 	struct async *as;
+ 	unsigned long flags;
+ 
+@@ -479,10 +481,13 @@ static void destroy_async(struct dev_state *ps, struct list_head *list)
+ 	while (!list_empty(list)) {
+ 		as = list_entry(list->next, struct async, asynclist);
+ 		list_del_init(&as->asynclist);
++		urb = as->urb;
++		usb_get_urb(urb);
+ 
+ 		/* drop the spinlock so the completion handler can run */
+ 		spin_unlock_irqrestore(&ps->lock, flags);
+-		usb_kill_urb(as->urb);
++		usb_kill_urb(urb);
++		usb_put_urb(urb);
+ 		spin_lock_irqsave(&ps->lock, flags);
+ 	}
+ 	spin_unlock_irqrestore(&ps->lock, flags);
+@@ -1410,12 +1415,24 @@ static int proc_submiturb(struct dev_state *ps, void __user *arg)
+ 
+ static int proc_unlinkurb(struct dev_state *ps, void __user *arg)
+ {
++	struct urb *urb;
+ 	struct async *as;
++	unsigned long flags;
+ 
++	spin_lock_irqsave(&ps->lock, flags);
+ 	as = async_getpending(ps, arg);
+-	if (!as)
++	if (!as) {
++		spin_unlock_irqrestore(&ps->lock, flags);
+ 		return -EINVAL;
+-	usb_kill_urb(as->urb);
++	}
++
++	urb = as->urb;
++	usb_get_urb(urb);
++	spin_unlock_irqrestore(&ps->lock, flags);
++
++	usb_kill_urb(urb);
++	usb_put_urb(urb);
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index ec6c97d..c8e0704 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -2499,6 +2499,10 @@ int usb_port_suspend(struct usb_device *udev, pm_message_t msg)
+ 				NULL, 0,
+ 				USB_CTRL_SET_TIMEOUT);
+ 
++		/* Try to enable USB2 hardware LPM again */
++		if (udev->usb2_hw_lpm_capable == 1)
++			usb_set_usb2_hardware_lpm(udev, 1);
++
+ 		/* System sleep transitions should never fail */
+ 		if (!PMSG_IS_AUTO(msg))
+ 			status = 0;
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 4c65eb6..32d3adc 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -123,6 +123,9 @@ static const struct usb_device_id usb_quirk_list[] = {
+ 	/* Guillemot Webcam Hercules Dualpix Exchange*/
+ 	{ USB_DEVICE(0x06f8, 0x3005), .driver_info = USB_QUIRK_RESET_RESUME },
+ 
++	/* Midiman M-Audio Keystation 88es */
++	{ USB_DEVICE(0x0763, 0x0192), .driver_info = USB_QUIRK_RESET_RESUME },
++
+ 	/* M-Systems Flash Disk Pioneers */
+ 	{ USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME },
+ 
+diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c
+index cd9b3a2..9d912bf 100644
+--- a/drivers/usb/core/urb.c
++++ b/drivers/usb/core/urb.c
+@@ -681,6 +681,27 @@ void usb_unpoison_urb(struct urb *urb)
+ EXPORT_SYMBOL_GPL(usb_unpoison_urb);
+ 
+ /**
++ * usb_block_urb - reliably prevent further use of an URB
++ * @urb: pointer to URB to be blocked, may be NULL
++ *
++ * After the routine has run, attempts to resubmit the URB will fail
++ * with error -EPERM.  Thus even if the URB's completion handler always
++ * tries to resubmit, it will not succeed and the URB will become idle.
++ *
++ * The URB must not be deallocated while this routine is running.  In
++ * particular, when a driver calls this routine, it must insure that the
++ * completion handler cannot deallocate the URB.
++ */
++void usb_block_urb(struct urb *urb)
++{
++	if (!urb)
++		return;
++
++	atomic_inc(&urb->reject);
++}
++EXPORT_SYMBOL_GPL(usb_block_urb);
++
++/**
+  * usb_kill_anchored_urbs - cancel transfer requests en masse
+  * @anchor: anchor the requests are bound to
+  *
+diff --git a/drivers/usb/gadget/fsl_udc_core.c b/drivers/usb/gadget/fsl_udc_core.c
+index 55abfb6..188a89f 100644
+--- a/drivers/usb/gadget/fsl_udc_core.c
++++ b/drivers/usb/gadget/fsl_udc_core.c
+@@ -736,6 +736,8 @@ static void fsl_queue_td(struct fsl_ep *ep, struct fsl_req *req)
+ 		lastreq = list_entry(ep->queue.prev, struct fsl_req, queue);
+ 		lastreq->tail->next_td_ptr =
+ 			cpu_to_hc32(req->head->td_dma & DTD_ADDR_MASK);
++		/* Ensure dTD's next dtd pointer to be updated */
++		wmb();
+ 		/* Read prime bit, if 1 goto done */
+ 		if (fsl_readl(&dr_regs->endpointprime) & bitmask)
+ 			return;
+diff --git a/drivers/usb/host/ehci-omap.c b/drivers/usb/host/ehci-omap.c
+index 5c78f9e..e669c6a 100644
+--- a/drivers/usb/host/ehci-omap.c
++++ b/drivers/usb/host/ehci-omap.c
+@@ -242,15 +242,6 @@ static int ehci_hcd_omap_probe(struct platform_device *pdev)
+ 
+ 	ehci_reset(omap_ehci);
+ 
+-	ret = usb_add_hcd(hcd, irq, IRQF_SHARED);
+-	if (ret) {
+-		dev_err(dev, "failed to add hcd with err %d\n", ret);
+-		goto err_add_hcd;
+-	}
+-
+-	/* root ports should always stay powered */
+-	ehci_port_power(omap_ehci, 1);
+-
+ 	if (pdata->phy_reset) {
+ 		/* Hold the PHY in RESET for enough time till
+ 		 * PHY is settled and ready
+@@ -264,6 +255,15 @@ static int ehci_hcd_omap_probe(struct platform_device *pdev)
+ 			gpio_set_value(pdata->reset_gpio_port[1], 1);
+ 	}
+ 
++	ret = usb_add_hcd(hcd, irq, IRQF_SHARED);
++	if (ret) {
++		dev_err(dev, "failed to add hcd with err %d\n", ret);
++		goto err_add_hcd;
++	}
++
++	/* root ports should always stay powered */
++	ehci_port_power(omap_ehci, 1);
++
+ 	return 0;
+ 
+ err_add_hcd:
+diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
+index fe8dc06..bc94d7b 100644
+--- a/drivers/usb/host/ehci-pci.c
++++ b/drivers/usb/host/ehci-pci.c
+@@ -368,7 +368,9 @@ static bool usb_is_intel_switchable_ehci(struct pci_dev *pdev)
+ {
+ 	return pdev->class == PCI_CLASS_SERIAL_USB_EHCI &&
+ 		pdev->vendor == PCI_VENDOR_ID_INTEL &&
+-		pdev->device == 0x1E26;
++		(pdev->device == 0x1E26 ||
++		 pdev->device == 0x8C2D ||
++		 pdev->device == 0x8C26);
+ }
+ 
+ static void ehci_enable_xhci_companion(void)
+diff --git a/drivers/usb/host/ehci-platform.c b/drivers/usb/host/ehci-platform.c
+index d238b4e2..82c1eb8 100644
+--- a/drivers/usb/host/ehci-platform.c
++++ b/drivers/usb/host/ehci-platform.c
+@@ -75,8 +75,6 @@ static const struct hc_driver ehci_platform_hc_driver = {
+ 	.relinquish_port	= ehci_relinquish_port,
+ 	.port_handed_over	= ehci_port_handed_over,
+ 
+-	.update_device		= ehci_update_device,
+-
+ 	.clear_tt_buffer_complete = ehci_clear_tt_buffer_complete,
+ };
+ 
+diff --git a/drivers/usb/host/ohci-at91.c b/drivers/usb/host/ohci-at91.c
+index 13ebeca..55d3d64 100644
+--- a/drivers/usb/host/ohci-at91.c
++++ b/drivers/usb/host/ohci-at91.c
+@@ -223,7 +223,7 @@ static void __devexit usb_hcd_at91_remove(struct usb_hcd *hcd,
+ /*-------------------------------------------------------------------------*/
+ 
+ static int __devinit
+-ohci_at91_start (struct usb_hcd *hcd)
++ohci_at91_reset (struct usb_hcd *hcd)
+ {
+ 	struct at91_usbh_data	*board = hcd->self.controller->platform_data;
+ 	struct ohci_hcd		*ohci = hcd_to_ohci (hcd);
+@@ -233,6 +233,14 @@ ohci_at91_start (struct usb_hcd *hcd)
+ 		return ret;
+ 
+ 	ohci->num_ports = board->ports;
++	return 0;
++}
++
++static int __devinit
++ohci_at91_start (struct usb_hcd *hcd)
++{
++	struct ohci_hcd		*ohci = hcd_to_ohci (hcd);
++	int			ret;
+ 
+ 	if ((ret = ohci_run(ohci)) < 0) {
+ 		err("can't start %s", hcd->self.bus_name);
+@@ -418,6 +426,7 @@ static const struct hc_driver ohci_at91_hc_driver = {
+ 	/*
+ 	 * basic lifecycle operations
+ 	 */
++	.reset =		ohci_at91_reset,
+ 	.start =		ohci_at91_start,
+ 	.stop =			ohci_stop,
+ 	.shutdown =		ohci_shutdown,
+diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
+index 32dada8..df0828c 100644
+--- a/drivers/usb/host/pci-quirks.c
++++ b/drivers/usb/host/pci-quirks.c
+@@ -9,6 +9,7 @@
+  */
+ 
+ #include <linux/types.h>
++#include <linux/kconfig.h>
+ #include <linux/kernel.h>
+ #include <linux/pci.h>
+ #include <linux/init.h>
+@@ -712,12 +713,28 @@ static int handshake(void __iomem *ptr, u32 mask, u32 done,
+ 	return -ETIMEDOUT;
+ }
+ 
+-bool usb_is_intel_switchable_xhci(struct pci_dev *pdev)
++#define PCI_DEVICE_ID_INTEL_LYNX_POINT_XHCI	0x8C31
++
++bool usb_is_intel_ppt_switchable_xhci(struct pci_dev *pdev)
+ {
+ 	return pdev->class == PCI_CLASS_SERIAL_USB_XHCI &&
+ 		pdev->vendor == PCI_VENDOR_ID_INTEL &&
+ 		pdev->device == PCI_DEVICE_ID_INTEL_PANTHERPOINT_XHCI;
+ }
++
++/* The Intel Lynx Point chipset also has switchable ports. */
++bool usb_is_intel_lpt_switchable_xhci(struct pci_dev *pdev)
++{
++	return pdev->class == PCI_CLASS_SERIAL_USB_XHCI &&
++		pdev->vendor == PCI_VENDOR_ID_INTEL &&
++		pdev->device == PCI_DEVICE_ID_INTEL_LYNX_POINT_XHCI;
++}
++
++bool usb_is_intel_switchable_xhci(struct pci_dev *pdev)
++{
++	return usb_is_intel_ppt_switchable_xhci(pdev) ||
++		usb_is_intel_lpt_switchable_xhci(pdev);
++}
+ EXPORT_SYMBOL_GPL(usb_is_intel_switchable_xhci);
+ 
+ /*
+@@ -742,6 +759,19 @@ void usb_enable_xhci_ports(struct pci_dev *xhci_pdev)
+ {
+ 	u32		ports_available;
+ 
++	/* Don't switchover the ports if the user hasn't compiled the xHCI
++	 * driver.  Otherwise they will see "dead" USB ports that don't power
++	 * the devices.
++	 */
++	if (!IS_ENABLED(CONFIG_USB_XHCI_HCD)) {
++		dev_warn(&xhci_pdev->dev,
++				"CONFIG_USB_XHCI_HCD is turned off, "
++				"defaulting to EHCI.\n");
++		dev_warn(&xhci_pdev->dev,
++				"USB 3.0 devices will work at USB 2.0 speeds.\n");
++		return;
++	}
++
+ 	ports_available = 0xffffffff;
+ 	/* Write USB3_PSSEN, the USB 3.0 Port SuperSpeed Enable
+ 	 * Register, to turn on SuperSpeed terminations for all
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index 673ad12..89850a8 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -558,6 +558,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ 				xhci_dbg(xhci, "Resume USB2 port %d\n",
+ 					wIndex + 1);
+ 				bus_state->resume_done[wIndex] = 0;
++				clear_bit(wIndex, &bus_state->resuming_ports);
+ 				xhci_set_link_state(xhci, port_array, wIndex,
+ 							XDEV_U0);
+ 				xhci_dbg(xhci, "set port %d resume\n",
+@@ -845,7 +846,12 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf)
+ 	/* Initial status is no changes */
+ 	retval = (max_ports + 8) / 8;
+ 	memset(buf, 0, retval);
+-	status = 0;
++
++	/*
++	 * Inform the usbcore about resume-in-progress by returning
++	 * a non-zero value even if there are no status changes.
++	 */
++	status = bus_state->resuming_ports;
+ 
+ 	mask = PORT_CSC | PORT_PEC | PORT_OCC | PORT_PLC | PORT_WRC;
+ 
+@@ -885,15 +891,11 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
+ 	spin_lock_irqsave(&xhci->lock, flags);
+ 
+ 	if (hcd->self.root_hub->do_remote_wakeup) {
+-		port_index = max_ports;
+-		while (port_index--) {
+-			if (bus_state->resume_done[port_index] != 0) {
+-				spin_unlock_irqrestore(&xhci->lock, flags);
+-				xhci_dbg(xhci, "suspend failed because "
+-						"port %d is resuming\n",
+-						port_index + 1);
+-				return -EBUSY;
+-			}
++		if (bus_state->resuming_ports) {
++			spin_unlock_irqrestore(&xhci->lock, flags);
++			xhci_dbg(xhci, "suspend failed because "
++						"a port is resuming\n");
++			return -EBUSY;
+ 		}
+ 	}
+ 
+diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
+index 68eaa90..497ed77 100644
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -1791,6 +1791,14 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
+ {
+ 	struct pci_dev	*pdev = to_pci_dev(xhci_to_hcd(xhci)->self.controller);
+ 	struct dev_info	*dev_info, *next;
++	struct list_head *tt_list_head;
++	struct list_head *tt;
++	struct list_head *endpoints;
++	struct list_head *ep, *q;
++	struct xhci_tt_bw_info *tt_info;
++	struct xhci_interval_bw_table *bwt;
++	struct xhci_virt_ep *virt_ep;
++
+ 	unsigned long	flags;
+ 	int size;
+ 	int i;
+@@ -1807,6 +1815,7 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
+ 	xhci->event_ring = NULL;
+ 	xhci_dbg(xhci, "Freed event ring\n");
+ 
++	xhci->cmd_ring_reserved_trbs = 0;
+ 	if (xhci->cmd_ring)
+ 		xhci_ring_free(xhci, xhci->cmd_ring);
+ 	xhci->cmd_ring = NULL;
+@@ -1849,8 +1858,26 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
+ 	}
+ 	spin_unlock_irqrestore(&xhci->lock, flags);
+ 
++	bwt = &xhci->rh_bw->bw_table;
++	for (i = 0; i < XHCI_MAX_INTERVAL; i++) {
++		endpoints = &bwt->interval_bw[i].endpoints;
++		list_for_each_safe(ep, q, endpoints) {
++			virt_ep = list_entry(ep, struct xhci_virt_ep, bw_endpoint_list);
++			list_del(&virt_ep->bw_endpoint_list);
++			kfree(virt_ep);
++		}
++	}
++
++	tt_list_head = &xhci->rh_bw->tts;
++	list_for_each_safe(tt, q, tt_list_head) {
++		tt_info = list_entry(tt, struct xhci_tt_bw_info, tt_list);
++		list_del(tt);
++		kfree(tt_info);
++	}
++
+ 	xhci->num_usb2_ports = 0;
+ 	xhci->num_usb3_ports = 0;
++	xhci->num_active_eps = 0;
+ 	kfree(xhci->usb2_ports);
+ 	kfree(xhci->usb3_ports);
+ 	kfree(xhci->port_array);
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 7a856a7..19e8921 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -72,6 +72,7 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ 		xhci_dbg(xhci, "QUIRK: Fresco Logic revision %u "
+ 				"has broken MSI implementation\n",
+ 				pdev->revision);
++		xhci->quirks |= XHCI_TRUST_TX_LENGTH;
+ 	}
+ 
+ 	if (pdev->vendor == PCI_VENDOR_ID_NEC)
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 3d9422f..525a1ee 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1377,6 +1377,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
+ 			xhci_dbg(xhci, "resume HS port %d\n", port_id);
+ 			bus_state->resume_done[faked_port_index] = jiffies +
+ 				msecs_to_jiffies(20);
++			set_bit(faked_port_index, &bus_state->resuming_ports);
+ 			mod_timer(&hcd->rh_timer,
+ 				  bus_state->resume_done[faked_port_index]);
+ 			/* Do the rest in GetPortStatus */
+@@ -1786,8 +1787,12 @@ static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_td *td,
+ 	/* handle completion code */
+ 	switch (trb_comp_code) {
+ 	case COMP_SUCCESS:
+-		frame->status = 0;
+-		break;
++		if (TRB_LEN(le32_to_cpu(event->transfer_len)) == 0) {
++			frame->status = 0;
++			break;
++		}
++		if ((xhci->quirks & XHCI_TRUST_TX_LENGTH))
++			trb_comp_code = COMP_SHORT_TX;
+ 	case COMP_SHORT_TX:
+ 		frame->status = td->urb->transfer_flags & URB_SHORT_NOT_OK ?
+ 				-EREMOTEIO : 0;
+@@ -1803,6 +1808,7 @@ static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_td *td,
+ 		break;
+ 	case COMP_DEV_ERR:
+ 	case COMP_STALL:
++	case COMP_TX_ERR:
+ 		frame->status = -EPROTO;
+ 		skip_td = true;
+ 		break;
+@@ -1883,13 +1889,16 @@ static int process_bulk_intr_td(struct xhci_hcd *xhci, struct xhci_td *td,
+ 	switch (trb_comp_code) {
+ 	case COMP_SUCCESS:
+ 		/* Double check that the HW transferred everything. */
+-		if (event_trb != td->last_trb) {
++		if (event_trb != td->last_trb ||
++				TRB_LEN(le32_to_cpu(event->transfer_len)) != 0) {
+ 			xhci_warn(xhci, "WARN Successful completion "
+ 					"on short TX\n");
+ 			if (td->urb->transfer_flags & URB_SHORT_NOT_OK)
+ 				*status = -EREMOTEIO;
+ 			else
+ 				*status = 0;
++			if ((xhci->quirks & XHCI_TRUST_TX_LENGTH))
++				trb_comp_code = COMP_SHORT_TX;
+ 		} else {
+ 			*status = 0;
+ 		}
+@@ -2048,6 +2057,13 @@ static int handle_tx_event(struct xhci_hcd *xhci,
+ 	 * transfer type
+ 	 */
+ 	case COMP_SUCCESS:
++		if (TRB_LEN(le32_to_cpu(event->transfer_len)) == 0)
++			break;
++		if (xhci->quirks & XHCI_TRUST_TX_LENGTH)
++			trb_comp_code = COMP_SHORT_TX;
++		else
++			xhci_warn(xhci, "WARN Successful completion on short TX: "
++					"needs XHCI_TRUST_TX_LENGTH quirk?\n");
+ 	case COMP_SHORT_TX:
+ 		break;
+ 	case COMP_STOP:
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 36641a7..5910048 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -152,7 +152,7 @@ int xhci_reset(struct xhci_hcd *xhci)
+ {
+ 	u32 command;
+ 	u32 state;
+-	int ret;
++	int ret, i;
+ 
+ 	state = xhci_readl(xhci, &xhci->op_regs->status);
+ 	if ((state & STS_HALT) == 0) {
+@@ -175,7 +175,15 @@ int xhci_reset(struct xhci_hcd *xhci)
+ 	 * xHCI cannot write to any doorbells or operational registers other
+ 	 * than status until the "Controller Not Ready" flag is cleared.
+ 	 */
+-	return handshake(xhci, &xhci->op_regs->status, STS_CNR, 0, 250 * 1000);
++	ret = handshake(xhci, &xhci->op_regs->status, STS_CNR, 0, 250 * 1000);
++
++	for (i = 0; i < 2; ++i) {
++		xhci->bus_state[i].port_c_suspend = 0;
++		xhci->bus_state[i].suspended_ports = 0;
++		xhci->bus_state[i].resuming_ports = 0;
++	}
++
++	return ret;
+ }
+ 
+ #ifdef CONFIG_PCI
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 3d69c4b..ac14276 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1362,6 +1362,8 @@ struct xhci_bus_state {
+ 	u32			suspended_ports;
+ 	u32			port_remote_wakeup;
+ 	unsigned long		resume_done[USB_MAXCHILDREN];
++	/* which ports have started to resume */
++	unsigned long		resuming_ports;
+ };
+ 
+ static inline unsigned int hcd_index(struct usb_hcd *hcd)
+@@ -1479,6 +1481,7 @@ struct xhci_hcd {
+ #define XHCI_RESET_ON_RESUME	(1 << 7)
+ #define	XHCI_SW_BW_CHECKING	(1 << 8)
+ #define XHCI_AMD_0x96_HOST	(1 << 9)
++#define XHCI_TRUST_TX_LENGTH	(1 << 10)
+ 	unsigned int		num_active_eps;
+ 	unsigned int		limit_active_eps;
+ 	/* There are two roothubs to keep track of bus suspend info for */
+diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
+index 9dcb68f..055b84a 100644
+--- a/drivers/usb/misc/usbtest.c
++++ b/drivers/usb/misc/usbtest.c
+@@ -1028,7 +1028,10 @@ test_ctrl_queue(struct usbtest_dev *dev, struct usbtest_param *param)
+ 		case 13:	/* short read, resembling case 10 */
+ 			req.wValue = cpu_to_le16((USB_DT_CONFIG << 8) | 0);
+ 			/* last data packet "should" be DATA1, not DATA0 */
+-			len = 1024 - udev->descriptor.bMaxPacketSize0;
++			if (udev->speed == USB_SPEED_SUPER)
++				len = 1024 - 512;
++			else
++				len = 1024 - udev->descriptor.bMaxPacketSize0;
+ 			expected = -EREMOTEIO;
+ 			break;
+ 		case 14:	/* short read; try to fill the last packet */
+@@ -1387,11 +1390,15 @@ static int test_halt(struct usbtest_dev *tdev, int ep, struct urb *urb)
+ 
+ static int halt_simple(struct usbtest_dev *dev)
+ {
+-	int		ep;
+-	int		retval = 0;
+-	struct urb	*urb;
++	int			ep;
++	int			retval = 0;
++	struct urb		*urb;
++	struct usb_device	*udev = testdev_to_usbdev(dev);
+ 
+-	urb = simple_alloc_urb(testdev_to_usbdev(dev), 0, 512);
++	if (udev->speed == USB_SPEED_SUPER)
++		urb = simple_alloc_urb(udev, 0, 1024);
++	else
++		urb = simple_alloc_urb(udev, 0, 512);
+ 	if (urb == NULL)
+ 		return -ENOMEM;
+ 
+diff --git a/drivers/usb/otg/gpio_vbus.c b/drivers/usb/otg/gpio_vbus.c
+index a0a2178..fe20864 100644
+--- a/drivers/usb/otg/gpio_vbus.c
++++ b/drivers/usb/otg/gpio_vbus.c
+@@ -37,7 +37,7 @@ struct gpio_vbus_data {
+ 	struct regulator       *vbus_draw;
+ 	int			vbus_draw_enabled;
+ 	unsigned		mA;
+-	struct work_struct	work;
++	struct delayed_work	work;
+ };
+ 
+ 
+@@ -94,7 +94,7 @@ static int is_vbus_powered(struct gpio_vbus_mach_info *pdata)
+ static void gpio_vbus_work(struct work_struct *work)
+ {
+ 	struct gpio_vbus_data *gpio_vbus =
+-		container_of(work, struct gpio_vbus_data, work);
++		container_of(work, struct gpio_vbus_data, work.work);
+ 	struct gpio_vbus_mach_info *pdata = gpio_vbus->dev->platform_data;
+ 	int gpio, status;
+ 
+@@ -152,7 +152,7 @@ static irqreturn_t gpio_vbus_irq(int irq, void *data)
+ 		otg->gadget ? otg->gadget->name : "none");
+ 
+ 	if (otg->gadget)
+-		schedule_work(&gpio_vbus->work);
++		schedule_delayed_work(&gpio_vbus->work, msecs_to_jiffies(100));
+ 
+ 	return IRQ_HANDLED;
+ }
+@@ -300,7 +300,7 @@ static int __init gpio_vbus_probe(struct platform_device *pdev)
+ 
+ 	ATOMIC_INIT_NOTIFIER_HEAD(&gpio_vbus->phy.notifier);
+ 
+-	INIT_WORK(&gpio_vbus->work, gpio_vbus_work);
++	INIT_DELAYED_WORK(&gpio_vbus->work, gpio_vbus_work);
+ 
+ 	gpio_vbus->vbus_draw = regulator_get(&pdev->dev, "vbus_draw");
+ 	if (IS_ERR(gpio_vbus->vbus_draw)) {
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 02e7f2d..95bba99 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -809,6 +809,7 @@ static struct usb_device_id id_table_combined [] = {
+ 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ 	{ USB_DEVICE(LARSENBRUSGAARD_VID, LB_ALTITRACK_PID) },
+ 	{ USB_DEVICE(GN_OTOMETRICS_VID, AURICAL_USB_PID) },
++	{ USB_DEVICE(PI_VID, PI_E861_PID) },
+ 	{ USB_DEVICE(BAYER_VID, BAYER_CONTOUR_CABLE_PID) },
+ 	{ USB_DEVICE(FTDI_VID, MARVELL_OPENRD_PID),
+ 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 0838baf8..f3c7c78 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -785,6 +785,14 @@
+ #define RTSYSTEMS_SERIAL_VX7_PID	0x9e52	/* Serial converter for VX-7 Radios using FT232RL */
+ #define RTSYSTEMS_CT29B_PID		0x9e54	/* CT29B Radio Cable */
+ 
++
++/*
++ * Physik Instrumente
++ * http://www.physikinstrumente.com/en/products/
++ */
++#define PI_VID              0x1a72  /* Vendor ID */
++#define PI_E861_PID         0x1008  /* E-861 piezo controller USB connection */
++
+ /*
+  * Bayer Ascensia Contour blood glucose meter USB-converter cable.
+  * http://winglucofacts.com/cables/
+diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
+index ab74123..3377437 100644
+--- a/drivers/usb/serial/ti_usb_3410_5052.c
++++ b/drivers/usb/serial/ti_usb_3410_5052.c
+@@ -165,7 +165,7 @@ static unsigned int product_5052_count;
+ /* the array dimension is the number of default entries plus */
+ /* TI_EXTRA_VID_PID_COUNT user defined entries plus 1 terminating */
+ /* null entry */
+-static struct usb_device_id ti_id_table_3410[14+TI_EXTRA_VID_PID_COUNT+1] = {
++static struct usb_device_id ti_id_table_3410[15+TI_EXTRA_VID_PID_COUNT+1] = {
+ 	{ USB_DEVICE(TI_VENDOR_ID, TI_3410_PRODUCT_ID) },
+ 	{ USB_DEVICE(TI_VENDOR_ID, TI_3410_EZ430_ID) },
+ 	{ USB_DEVICE(MTS_VENDOR_ID, MTS_GSM_NO_FW_PRODUCT_ID) },
+@@ -180,6 +180,7 @@ static struct usb_device_id ti_id_table_3410[14+TI_EXTRA_VID_PID_COUNT+1] = {
+ 	{ USB_DEVICE(IBM_VENDOR_ID, IBM_454B_PRODUCT_ID) },
+ 	{ USB_DEVICE(IBM_VENDOR_ID, IBM_454C_PRODUCT_ID) },
+ 	{ USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_PRODUCT_ID) },
++	{ USB_DEVICE(TI_VENDOR_ID, FRI2_PRODUCT_ID) },
+ };
+ 
+ static struct usb_device_id ti_id_table_5052[5+TI_EXTRA_VID_PID_COUNT+1] = {
+@@ -189,7 +190,7 @@ static struct usb_device_id ti_id_table_5052[5+TI_EXTRA_VID_PID_COUNT+1] = {
+ 	{ USB_DEVICE(TI_VENDOR_ID, TI_5052_FIRMWARE_PRODUCT_ID) },
+ };
+ 
+-static struct usb_device_id ti_id_table_combined[18+2*TI_EXTRA_VID_PID_COUNT+1] = {
++static struct usb_device_id ti_id_table_combined[19+2*TI_EXTRA_VID_PID_COUNT+1] = {
+ 	{ USB_DEVICE(TI_VENDOR_ID, TI_3410_PRODUCT_ID) },
+ 	{ USB_DEVICE(TI_VENDOR_ID, TI_3410_EZ430_ID) },
+ 	{ USB_DEVICE(MTS_VENDOR_ID, MTS_GSM_NO_FW_PRODUCT_ID) },
+@@ -208,6 +209,7 @@ static struct usb_device_id ti_id_table_combined[18+2*TI_EXTRA_VID_PID_COUNT+1]
+ 	{ USB_DEVICE(IBM_VENDOR_ID, IBM_454B_PRODUCT_ID) },
+ 	{ USB_DEVICE(IBM_VENDOR_ID, IBM_454C_PRODUCT_ID) },
+ 	{ USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_PRODUCT_ID) },
++	{ USB_DEVICE(TI_VENDOR_ID, FRI2_PRODUCT_ID) },
+ 	{ }
+ };
+ 
+diff --git a/drivers/usb/serial/ti_usb_3410_5052.h b/drivers/usb/serial/ti_usb_3410_5052.h
+index f140f1b..b353e7e 100644
+--- a/drivers/usb/serial/ti_usb_3410_5052.h
++++ b/drivers/usb/serial/ti_usb_3410_5052.h
+@@ -37,6 +37,7 @@
+ #define TI_5152_BOOT_PRODUCT_ID		0x5152	/* no EEPROM, no firmware */
+ #define TI_5052_EEPROM_PRODUCT_ID	0x505A	/* EEPROM, no firmware */
+ #define TI_5052_FIRMWARE_PRODUCT_ID	0x505F	/* firmware is running */
++#define FRI2_PRODUCT_ID			0x5053  /* Fish River Island II */
+ 
+ /* Multi-Tech vendor and product ids */
+ #define MTS_VENDOR_ID			0x06E0
+diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
+index 97355a1..6933355 100644
+--- a/drivers/usb/serial/usb-serial.c
++++ b/drivers/usb/serial/usb-serial.c
+@@ -1338,7 +1338,6 @@ static int usb_serial_register(struct usb_serial_driver *driver)
+ 				driver->description);
+ 		return -EINVAL;
+ 	}
+-	driver->usb_driver->supports_autosuspend = 1;
+ 
+ 	/* Add this device to our list of devices */
+ 	mutex_lock(&table_lock);
+@@ -1373,7 +1372,7 @@ static void usb_serial_deregister(struct usb_serial_driver *device)
+  * @serial_drivers: NULL-terminated array of pointers to drivers to be registered
+  *
+  * Registers @udriver and all the drivers in the @serial_drivers array.
+- * Automatically fills in the .no_dynamic_id field in @udriver and
++ * Automatically fills in the .no_dynamic_id and PM fields in @udriver and
+  * the .usb_driver field in each serial driver.
+  */
+ int usb_serial_register_drivers(struct usb_driver *udriver,
+@@ -1392,11 +1391,17 @@ int usb_serial_register_drivers(struct usb_driver *udriver,
+ 	 * the serial drivers are registered, because the probe would
+ 	 * simply fail for lack of a matching serial driver.
+ 	 * Therefore save off udriver's id_table until we are all set.
++	 *
++	 * Suspend/resume support is implemented in the usb-serial core,
++	 * so fill in the PM-related fields in udriver.
+ 	 */
+ 	saved_id_table = udriver->id_table;
+ 	udriver->id_table = NULL;
+ 
+ 	udriver->no_dynamic_id = 1;
++	udriver->supports_autosuspend = 1;
++	udriver->suspend = usb_serial_suspend;
++	udriver->resume = usb_serial_resume;
+ 	rc = usb_register(udriver);
+ 	if (rc)
+ 		return rc;
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index 856ad92..8f3cbb8 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -1885,6 +1885,13 @@ UNUSUAL_DEV(  0x1652, 0x6600, 0x0201, 0x0201,
+ 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ 		US_FL_IGNORE_RESIDUE ),
+ 
++/* Reported by Jesse Feddema <jdfeddema@gmail.com> */
++UNUSUAL_DEV(  0x177f, 0x0400, 0x0000, 0x0000,
++		"Yarvik",
++		"PMP400",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++		US_FL_BULK_IGNORE_TAG | US_FL_MAX_SECTORS_64 ),
++
+ /* Reported by Hans de Goede <hdegoede@redhat.com>
+  * These Appotech controllers are found in Picture Frames, they provide a
+  * (buggy) emulation of a cdrom drive which contains the windows software
+diff --git a/drivers/video/sh_mobile_lcdcfb.c b/drivers/video/sh_mobile_lcdcfb.c
+index 7a0b301..e672698 100644
+--- a/drivers/video/sh_mobile_lcdcfb.c
++++ b/drivers/video/sh_mobile_lcdcfb.c
+@@ -758,7 +758,7 @@ static void __sh_mobile_lcdc_start(struct sh_mobile_lcdc_priv *priv)
+ 		}
+ 
+ 		lcdc_write_chan(ch, LDDFR, tmp);
+-		lcdc_write_chan(ch, LDMLSR, ch->pitch);
++		lcdc_write_chan(ch, LDMLSR, ch->line_size);
+ 		lcdc_write_chan(ch, LDSA1R, ch->base_addr_y);
+ 		if (ch->format->yuv)
+ 			lcdc_write_chan(ch, LDSA2R, ch->base_addr_c);
+@@ -847,6 +847,7 @@ static int sh_mobile_lcdc_start(struct sh_mobile_lcdc_priv *priv)
+ 
+ 		ch->base_addr_y = ch->dma_handle;
+ 		ch->base_addr_c = ch->base_addr_y + ch->xres * ch->yres_virtual;
++		ch->line_size = ch->pitch;
+ 
+ 		/* Enable MERAM if possible. */
+ 		if (mdev == NULL || mdev->ops == NULL ||
+@@ -882,7 +883,7 @@ static int sh_mobile_lcdc_start(struct sh_mobile_lcdc_priv *priv)
+ 
+ 		meram = mdev->ops->meram_register(mdev, ch->cfg->meram_cfg,
+ 					ch->pitch, ch->yres, pixelformat,
+-					&ch->pitch);
++					&ch->line_size);
+ 		if (!IS_ERR(meram)) {
+ 			mdev->ops->meram_update(mdev, meram,
+ 					ch->base_addr_y, ch->base_addr_c,
+diff --git a/drivers/video/sh_mobile_lcdcfb.h b/drivers/video/sh_mobile_lcdcfb.h
+index da1c26e..5c3bddd 100644
+--- a/drivers/video/sh_mobile_lcdcfb.h
++++ b/drivers/video/sh_mobile_lcdcfb.h
+@@ -84,6 +84,7 @@ struct sh_mobile_lcdc_chan {
+ 
+ 	unsigned long base_addr_y;
+ 	unsigned long base_addr_c;
++	unsigned int line_size;
+ 
+ 	int (*notify)(struct sh_mobile_lcdc_chan *ch,
+ 		      enum sh_mobile_lcdc_entity_event event,
+diff --git a/drivers/xen/events.c b/drivers/xen/events.c
+index 0a8a17c..6908e4c 100644
+--- a/drivers/xen/events.c
++++ b/drivers/xen/events.c
+@@ -611,7 +611,7 @@ static void disable_pirq(struct irq_data *data)
+ 	disable_dynirq(data);
+ }
+ 
+-static int find_irq_by_gsi(unsigned gsi)
++int xen_irq_from_gsi(unsigned gsi)
+ {
+ 	struct irq_info *info;
+ 
+@@ -625,6 +625,7 @@ static int find_irq_by_gsi(unsigned gsi)
+ 
+ 	return -1;
+ }
++EXPORT_SYMBOL_GPL(xen_irq_from_gsi);
+ 
+ /*
+  * Do not make any assumptions regarding the relationship between the
+@@ -644,7 +645,7 @@ int xen_bind_pirq_gsi_to_irq(unsigned gsi,
+ 
+ 	mutex_lock(&irq_mapping_update_lock);
+ 
+-	irq = find_irq_by_gsi(gsi);
++	irq = xen_irq_from_gsi(gsi);
+ 	if (irq != -1) {
+ 		printk(KERN_INFO "xen_map_pirq_gsi: returning irq %d for gsi %u\n",
+ 		       irq, gsi);
+diff --git a/fs/aio.c b/fs/aio.c
+index 67a6db3..e7f2fad 100644
+--- a/fs/aio.c
++++ b/fs/aio.c
+@@ -1456,6 +1456,10 @@ static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb, bool compat)
+ 	if (ret < 0)
+ 		goto out;
+ 
++	ret = rw_verify_area(type, kiocb->ki_filp, &kiocb->ki_pos, ret);
++	if (ret < 0)
++		goto out;
++
+ 	kiocb->ki_nr_segs = kiocb->ki_nbytes;
+ 	kiocb->ki_cur_seg = 0;
+ 	/* ki_nbytes/left now reflect bytes instead of segs */
+@@ -1467,11 +1471,17 @@ out:
+ 	return ret;
+ }
+ 
+-static ssize_t aio_setup_single_vector(struct kiocb *kiocb)
++static ssize_t aio_setup_single_vector(int type, struct file * file, struct kiocb *kiocb)
+ {
++	int bytes;
++
++	bytes = rw_verify_area(type, file, &kiocb->ki_pos, kiocb->ki_left);
++	if (bytes < 0)
++		return bytes;
++
+ 	kiocb->ki_iovec = &kiocb->ki_inline_vec;
+ 	kiocb->ki_iovec->iov_base = kiocb->ki_buf;
+-	kiocb->ki_iovec->iov_len = kiocb->ki_left;
++	kiocb->ki_iovec->iov_len = bytes;
+ 	kiocb->ki_nr_segs = 1;
+ 	kiocb->ki_cur_seg = 0;
+ 	return 0;
+@@ -1496,10 +1506,7 @@ static ssize_t aio_setup_iocb(struct kiocb *kiocb, bool compat)
+ 		if (unlikely(!access_ok(VERIFY_WRITE, kiocb->ki_buf,
+ 			kiocb->ki_left)))
+ 			break;
+-		ret = security_file_permission(file, MAY_READ);
+-		if (unlikely(ret))
+-			break;
+-		ret = aio_setup_single_vector(kiocb);
++		ret = aio_setup_single_vector(READ, file, kiocb);
+ 		if (ret)
+ 			break;
+ 		ret = -EINVAL;
+@@ -1514,10 +1521,7 @@ static ssize_t aio_setup_iocb(struct kiocb *kiocb, bool compat)
+ 		if (unlikely(!access_ok(VERIFY_READ, kiocb->ki_buf,
+ 			kiocb->ki_left)))
+ 			break;
+-		ret = security_file_permission(file, MAY_WRITE);
+-		if (unlikely(ret))
+-			break;
+-		ret = aio_setup_single_vector(kiocb);
++		ret = aio_setup_single_vector(WRITE, file, kiocb);
+ 		if (ret)
+ 			break;
+ 		ret = -EINVAL;
+@@ -1528,9 +1532,6 @@ static ssize_t aio_setup_iocb(struct kiocb *kiocb, bool compat)
+ 		ret = -EBADF;
+ 		if (unlikely(!(file->f_mode & FMODE_READ)))
+ 			break;
+-		ret = security_file_permission(file, MAY_READ);
+-		if (unlikely(ret))
+-			break;
+ 		ret = aio_setup_vectored_rw(READ, kiocb, compat);
+ 		if (ret)
+ 			break;
+@@ -1542,9 +1543,6 @@ static ssize_t aio_setup_iocb(struct kiocb *kiocb, bool compat)
+ 		ret = -EBADF;
+ 		if (unlikely(!(file->f_mode & FMODE_WRITE)))
+ 			break;
+-		ret = security_file_permission(file, MAY_WRITE);
+-		if (unlikely(ret))
+-			break;
+ 		ret = aio_setup_vectored_rw(WRITE, kiocb, compat);
+ 		if (ret)
+ 			break;
+diff --git a/include/linux/mmc/host.h b/include/linux/mmc/host.h
+index cbde4b7..0707d22 100644
+--- a/include/linux/mmc/host.h
++++ b/include/linux/mmc/host.h
+@@ -297,6 +297,7 @@ struct mmc_host {
+ 
+ 	unsigned int		sdio_irqs;
+ 	struct task_struct	*sdio_irq_thread;
++	bool			sdio_irq_pending;
+ 	atomic_t		sdio_irq_thread_abort;
+ 
+ 	mmc_pm_flag_t		pm_flags;	/* requested pm features */
+@@ -352,6 +353,7 @@ extern int mmc_cache_ctrl(struct mmc_host *, u8);
+ static inline void mmc_signal_sdio_irq(struct mmc_host *host)
+ {
+ 	host->ops->enable_sdio_irq(host, 0);
++	host->sdio_irq_pending = true;
+ 	wake_up_process(host->sdio_irq_thread);
+ }
+ 
+diff --git a/include/linux/usb.h b/include/linux/usb.h
+index 73b68d1..26229fd 100644
+--- a/include/linux/usb.h
++++ b/include/linux/usb.h
+@@ -1379,6 +1379,7 @@ extern int usb_unlink_urb(struct urb *urb);
+ extern void usb_kill_urb(struct urb *urb);
+ extern void usb_poison_urb(struct urb *urb);
+ extern void usb_unpoison_urb(struct urb *urb);
++extern void usb_block_urb(struct urb *urb);
+ extern void usb_kill_anchored_urbs(struct usb_anchor *anchor);
+ extern void usb_poison_anchored_urbs(struct usb_anchor *anchor);
+ extern void usb_unpoison_anchored_urbs(struct usb_anchor *anchor);
+@@ -1391,6 +1392,8 @@ extern struct urb *usb_get_from_anchor(struct usb_anchor *anchor);
+ extern void usb_scuttle_anchored_urbs(struct usb_anchor *anchor);
+ extern int usb_anchor_empty(struct usb_anchor *anchor);
+ 
++#define usb_unblock_urb	usb_unpoison_urb
++
+ /**
+  * usb_urb_dir_in - check if an URB describes an IN transfer
+  * @urb: URB to be checked
+diff --git a/include/xen/events.h b/include/xen/events.h
+index 0f77370..04399b2 100644
+--- a/include/xen/events.h
++++ b/include/xen/events.h
+@@ -103,6 +103,9 @@ int xen_irq_from_pirq(unsigned pirq);
+ /* Return the pirq allocated to the irq. */
+ int xen_pirq_from_irq(unsigned irq);
+ 
++/* Return the irq allocated to the gsi */
++int xen_irq_from_gsi(unsigned gsi);
++
+ /* Determine whether to ignore this IRQ if it is passed to a guest. */
+ int xen_test_irq_shared(int irq);
+ 
+diff --git a/init/main.c b/init/main.c
+index 44b2433..cb54cd3 100644
+--- a/init/main.c
++++ b/init/main.c
+@@ -560,9 +560,6 @@ asmlinkage void __init start_kernel(void)
+ 	early_boot_irqs_disabled = false;
+ 	local_irq_enable();
+ 
+-	/* Interrupts are enabled now so all GFP allocations are safe. */
+-	gfp_allowed_mask = __GFP_BITS_MASK;
+-
+ 	kmem_cache_init_late();
+ 
+ 	/*
+@@ -842,6 +839,10 @@ static int __init kernel_init(void * unused)
+ 	 * Wait until kthreadd is all set-up.
+ 	 */
+ 	wait_for_completion(&kthreadd_done);
++
++	/* Now the scheduler is fully set up and can do blocking allocations */
++	gfp_allowed_mask = __GFP_BITS_MASK;
++
+ 	/*
+ 	 * init can allocate pages on any node
+ 	 */
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index 5abf42f..7da267c 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -1210,8 +1210,13 @@ static void worker_enter_idle(struct worker *worker)
+ 	} else
+ 		wake_up_all(&gcwq->trustee_wait);
+ 
+-	/* sanity check nr_running */
+-	WARN_ON_ONCE(gcwq->nr_workers == gcwq->nr_idle &&
++	/*
++	 * Sanity check nr_running.  Because trustee releases gcwq->lock
++	 * between setting %WORKER_ROGUE and zapping nr_running, the
++	 * warning may trigger spuriously.  Check iff trustee is idle.
++	 */
++	WARN_ON_ONCE(gcwq->trustee_state == TRUSTEE_DONE &&
++		     gcwq->nr_workers == gcwq->nr_idle &&
+ 		     atomic_read(get_gcwq_nr_running(gcwq->cpu)));
+ }
+ 
+diff --git a/mm/mempolicy.c b/mm/mempolicy.c
+index b195691..bf5b485 100644
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -607,27 +607,6 @@ check_range(struct mm_struct *mm, unsigned long start, unsigned long end,
+ 	return first;
+ }
+ 
+-/* Apply policy to a single VMA */
+-static int policy_vma(struct vm_area_struct *vma, struct mempolicy *new)
+-{
+-	int err = 0;
+-	struct mempolicy *old = vma->vm_policy;
+-
+-	pr_debug("vma %lx-%lx/%lx vm_ops %p vm_file %p set_policy %p\n",
+-		 vma->vm_start, vma->vm_end, vma->vm_pgoff,
+-		 vma->vm_ops, vma->vm_file,
+-		 vma->vm_ops ? vma->vm_ops->set_policy : NULL);
+-
+-	if (vma->vm_ops && vma->vm_ops->set_policy)
+-		err = vma->vm_ops->set_policy(vma, new);
+-	if (!err) {
+-		mpol_get(new);
+-		vma->vm_policy = new;
+-		mpol_put(old);
+-	}
+-	return err;
+-}
+-
+ /* Step 2: apply policy to a range and do splits. */
+ static int mbind_range(struct mm_struct *mm, unsigned long start,
+ 		       unsigned long end, struct mempolicy *new_pol)
+@@ -676,9 +655,23 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
+ 			if (err)
+ 				goto out;
+ 		}
+-		err = policy_vma(vma, new_pol);
+-		if (err)
+-			goto out;
++
++		/*
++		 * Apply policy to a single VMA. The reference counting of
++		 * policy for vma_policy linkages has already been handled by
++		 * vma_merge and split_vma as necessary. If this is a shared
++		 * policy then ->set_policy will increment the reference count
++		 * for an sp node.
++		 */
++		pr_debug("vma %lx-%lx/%lx vm_ops %p vm_file %p set_policy %p\n",
++			vma->vm_start, vma->vm_end, vma->vm_pgoff,
++			vma->vm_ops, vma->vm_file,
++			vma->vm_ops ? vma->vm_ops->set_policy : NULL);
++		if (vma->vm_ops && vma->vm_ops->set_policy) {
++			err = vma->vm_ops->set_policy(vma, new_pol);
++			if (err)
++				goto out;
++		}
+ 	}
+ 
+  out:
+diff --git a/net/wireless/reg.c b/net/wireless/reg.c
+index e9a0ac8..15f3474 100644
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -388,7 +388,15 @@ static void reg_regdb_query(const char *alpha2)
+ 
+ 	schedule_work(&reg_regdb_work);
+ }
++
++/* Feel free to add any other sanity checks here */
++static void reg_regdb_size_check(void)
++{
++	/* We should ideally BUILD_BUG_ON() but then random builds would fail */
++	WARN_ONCE(!reg_regdb_size, "db.txt is empty, you should update it...");
++}
+ #else
++static inline void reg_regdb_size_check(void) {}
+ static inline void reg_regdb_query(const char *alpha2) {}
+ #endif /* CONFIG_CFG80211_INTERNAL_REGDB */
+ 
+@@ -2322,6 +2330,8 @@ int __init regulatory_init(void)
+ 	spin_lock_init(&reg_requests_lock);
+ 	spin_lock_init(&reg_pending_beacons_lock);
+ 
++	reg_regdb_size_check();
++
+ 	cfg80211_regdomain = cfg80211_world_regdom;
+ 
+ 	user_alpha2[0] = '9';
+diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
+index d7018bf..3068d16 100644
+--- a/security/selinux/selinuxfs.c
++++ b/security/selinux/selinuxfs.c
+@@ -1232,6 +1232,7 @@ static int sel_make_bools(void)
+ 		kfree(bool_pending_names[i]);
+ 	kfree(bool_pending_names);
+ 	kfree(bool_pending_values);
++	bool_num = 0;
+ 	bool_pending_names = NULL;
+ 	bool_pending_values = NULL;
+ 
+diff --git a/tools/usb/ffs-test.c b/tools/usb/ffs-test.c
+index 4b107b5..8674b9e 100644
+--- a/tools/usb/ffs-test.c
++++ b/tools/usb/ffs-test.c
+@@ -297,7 +297,7 @@ static void *start_thread_helper(void *arg)
+ 
+ 		ret = t->in(t, t->buf, t->buf_size);
+ 		if (ret > 0) {
+-			ret = t->out(t, t->buf, t->buf_size);
++			ret = t->out(t, t->buf, ret);
+ 			name = out_name;
+ 			op = "write";
+ 		} else {